Finding: Weak Password Policy

This guidance explains risks from weak passwords—both easily guessed and easily cracked—and recommends shifting to long passphrases (minimum ~15 characters, multiple dictionary words, allowing title case and digit substitution), reducing opportunities for hash collection, and deploying mitigations such as MFA, Credential Guard, admin-only admin workstations, and password managers to limit credential theft and lateral compromise.