How to answer 'What is your password policy?' on a CAIQ
I. Reviewer Guidance & Pitfalls
If you mandate SSO with MFA across all systems, emphasize that first: modern reviewers prefer 'SSO + MFA everywhere' over complex 90-day password rotation policies. If passwords are used, state minimum length (e.g. 14+ characters) and lockout thresholds.
II. Example Answer Passing Enterprise Audit
Compliant Response
Sealed · IAM-09
All workforce authentication is enforced via centralized SSO with mandatory MFA; direct passwords for production accounts are disabled. Service credentials require minimum 24-character high-entropy secrets (SOC 2, CC6.1).
Filling out a CAIQ or SIG Lite right now?
QuietQuestionnaire drafts answers with citations pulled directly from your own SOC 2 report, catches contradictions reviewers reject, and locks exports behind cryptographic human sign-off.
No spam · No credit card · Confidential by default