STIGQter: STIG Summary: Okta Identity as a Service (IDaaS) Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 05 Jan 2026:

Okta must enforce password complexity by requiring that at least one special character be used.

DISA Rule

SV-273199r1098864_rule

Vulnerability Number

V-273199

Group Title

SRG-APP-000169

Rule Version

OKTA-APP-000700

Severity

CAT II

CCI(s)

• CCI-004066 - For password-based authentication, enforce organization-defined composition and complexity rules.

Weight

10

Fix Recommendation

From the Admin Console:
1. Select Security >> Authenticators.
2. Click the "Actions" button next to the "Password" row and select "Edit".
3. For each listed policy:
- Click "Edit".
- Set "Symbol (e.g., !@#$%^&*)" to checked.

Check Contents

From the Admin Console:
1. Select Security >> Authenticators.
2. Click the "Actions" button next to the "Password" row and select "Edit".
3. For each listed policy, verify "Symbol (e.g., !@#$%^&*)" is checked.

For each policy, if "Symbol (e.g., !@#$%^&*)" is not checked, this is a finding.

Vulnerability Number

V-273199

Documentable

False

Rule Version

OKTA-APP-000700

Severity Override Guidance

From the Admin Console:
1. Select Security >> Authenticators.
2. Click the "Actions" button next to the "Password" row and select "Edit".
3. For each listed policy, verify "Symbol (e.g., !@#$%^&*)" is checked.

For each policy, if "Symbol (e.g., !@#$%^&*)" is not checked, this is a finding.

Check Content Reference

M

Target Key

5694