Okta must enforce 24 hours/one day as the minimum password lifetime.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-273200 | OKTA-APP-000740 | SV-273200r1098867_rule | Medium |
| Description |
| Enforcing a minimum password lifetime helps prevent repeated password changes to defeat the password reuse or history enforcement requirement. Restricting this setting limits the user's ability to change their password. Passwords must be changed at specific policy-based intervals; however, if the application allows the user to immediately and continually change their password, it could be changed repeatedly in a short period of time to defeat the organization's policy regarding password reuse. Satisfies: SRG-APP-000173, SRG-APP-000870 |
| STIG | Date |
| Okta Identity as a Service (IDaaS) Security Technical Implementation Guide | 2025-05-06 |
Details
| Check Text (C-77291r1098865_chk) |
| From the Admin Console: 1. Select Security >> Authenticators. 2. Click the "Actions" button next to the "Password" row and select "Edit". 3. For each listed policy, verify "Minimum password age is XX hours" is set to at least "24". For each policy, if "Minimum password age is XX hours" is not set to at least "24", this is a finding. |
| Fix Text (F-77196r1098866_fix) |
| From the Admin Console: 1. Select Security >> Authenticators. 2. Click the "Actions" button next to the "Password" row and select "Edit". 3. For each listed policy: - Click "Edit". - Set "Minimum password age is XX hours" to at least "24". |