8.3.8—Authentication policies and procedures are documented and communicated to all users including: Guidance on selecting strong authentication factors.

>Requirement Description

Authentication policies and procedures are documented and communicated to all users including: Guidance on selecting strong authentication factors. Guidance for how users should protect their authentication factors. Instructions not to reuse previously used passwords/passphrases. Instructions to change passwords/passphrases if there is any suspicion or knowledge that the password/passphrases have been compromised and how to report the incident.