STIGQter: STIG Summary: Okta Identity as a Service (IDaaS) Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 05 Jan 2026:

Okta must enforce password complexity by requiring that at least one lowercase character be used.

DISA Rule

SV-273197r1098858_rule

Vulnerability Number

V-273197

Group Title

SRG-APP-000167

Rule Version

OKTA-APP-000680

Severity

CAT II

CCI(s)

• CCI-004066 - For password-based authentication, enforce organization-defined composition and complexity rules.

Weight

10

Fix Recommendation

From the Admin Console:
1. Select Security >> Authenticators.
2. Click the "Actions" button next to the "Password" row and select "Edit".
3. For each listed policy:
- Click "Edit".
- Set "Lower case letter" to checked.

Check Contents

From the Admin Console:
1. Select Security >> Authenticators.
2. Click the "Actions" button next to the "Password" row and select "Edit".
3. For each listed policy, verify "Lower case letter" is checked.

For each policy, if "Lower case letter" is not checked, this is a finding.

Vulnerability Number

V-273197

Documentable

False

Rule Version

OKTA-APP-000680

Severity Override Guidance

From the Admin Console:
1. Select Security >> Authenticators.
2. Click the "Actions" button next to the "Password" row and select "Edit".
3. For each listed policy, verify "Lower case letter" is checked.

For each policy, if "Lower case letter" is not checked, this is a finding.

Check Content Reference

M

Target Key

5694