3.5.8

5.5.2.3 Organizations shall have clear policies on password length and reuse, the use of password managers and if, when, and how users can physically write down and securely store a password.
NOTE: Organizations may use password selection guidance from the Communications Security Establishment’s User Authentication Guidance for Information Technology Systems