STIGQter: STIG Summary: Okta Identity as a Service (IDaaS) Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 05 Jan 2026:

Okta must enforce password complexity by requiring that at least one uppercase character be used.

DISA Rule

SV-273196r1098855_rule

Vulnerability Number

V-273196

Group Title

SRG-APP-000166

Rule Version

OKTA-APP-000670

Severity

CAT II

CCI(s)

• CCI-004066 - For password-based authentication, enforce organization-defined composition and complexity rules.

Weight

10

Fix Recommendation

From the Admin Console:
1. Select Security >> Authenticators.
2. Click the "Actions" button next to the "Password" row and select "Edit".
3. For each listed policy:
- Click "Edit".
- Set "Upper case letter" to checked.

Check Contents

From the Admin Console:
1. Select Security >> Authenticators.
2. Click the "Actions" button next to the "Password" row and select "Edit".
3. For each listed policy, verify "Upper case letter" is checked.

For each policy, if "Upper case letter" is not checked, this is a finding.

Vulnerability Number

V-273196

Documentable

False

Rule Version

OKTA-APP-000670

Severity Override Guidance

From the Admin Console:
1. Select Security >> Authenticators.
2. Click the "Actions" button next to the "Password" row and select "Edit".
3. For each listed policy, verify "Upper case letter" is checked.

For each policy, if "Upper case letter" is not checked, this is a finding.

Check Content Reference

M

Target Key

5694