credentials to verify a user's identity.

PROCESS:

Password Creation Requirements

A strong password is long and contains a mix of letters, numbers, and special characters. All passwords used to access KSU IT resources must meet the following requirements:

• Be a minimum of 12 characters in length.
• Contain at least one character from any of the following categories:
• Contain an uppercase alphabet character (A-Z)
• Contain a special character (*, %, !, etc.)
• Contain a numeric character (0-9)
• Must not contain any part of the user's account name.
• Cannot match any of the user's last three (3) passwords.

Password Protection and Handling

Users are responsible for maintaining the confidentiality of their passwords. The following protection rules apply:

• Passwords shall be treated as confidential information and must not be shared with anyone.
• Passwords must be promptly changed if they are suspected of being compromised.
• Passwords must not be written down or stored in an insecure manner (e.g., taped to a monitor). If a password must be stored, an encrypted password manager must be used.
• Passwords should not be emailed with usernames.
• Users must not save passwords in web browsers or use the "remember password" feature in applications.
• Users should not use their KSU password for any non-KSU accounts.
• The KSU IT department will never ask for a user's password.

System Security Controls

• After three (3) failed password attempts, a user's account will be locked out.
• Password-protected screen savers are mandatory on all university-owned computers and must be set to a maximum timeout of fifteen (15) minutes.

Frequency of Password Changes

KSU network passwords will expire every 180 days. Users will receive a notification prompting them to change their password beginning fourteen (14) days prior to expiration.

Password Reset Procedure