STIGQter: STIG Summary: Okta Identity as a Service (IDaaS) Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 05 Jan 2026:

Okta must enforce password complexity by requiring that at least one numeric character be used.

DISA Rule

SV-273198r1098861_rule

Vulnerability Number

V-273198

Group Title

SRG-APP-000168

Rule Version

OKTA-APP-000690

Severity

CAT II

CCI(s)

• CCI-004066 - For password-based authentication, enforce organization-defined composition and complexity rules.

Weight

10

Fix Recommendation

From the Admin Console:
1. Select Security >> Authenticators.
2. Click the "Actions" button next to the "Password" row and select "Edit".
3. For each listed policy:
- Click "Edit".
- Set "Number (0-9)" to checked.

Check Contents

From the Admin Console:
1. Select Security >> Authenticators.
2. Click the "Actions" button next to the "Password" row and select "Edit".
3. For each listed policy, verify "Number (0-9)" is checked.

For each policy, if "Number (0-9)" is not checked, this is a finding.

Vulnerability Number

V-273198

Documentable

False

Rule Version

OKTA-APP-000690

Severity Override Guidance

From the Admin Console:
1. Select Security >> Authenticators.
2. Click the "Actions" button next to the "Password" row and select "Edit".
3. For each listed policy, verify "Number (0-9)" is checked.

For each policy, if "Number (0-9)" is not checked, this is a finding.

Check Content Reference

M

Target Key

5694