For what it is worth OWASP has password guidelines: https://www.owasp.org/index.php/Password_length_&_complexity https://www.owasp.org/index.php/Password_lengt

For what it is worth OWASP has password guidelines: https://www.owasp.org/index.php/Password_length_&_complexity https://www.owasp.org/index.php/Password_length_&_comple... That should be enough? I can't imagine that you are lamenting the lack of an oversight body to to adopt and enforce a standard. Were you?