OAR 291-005-0055: User Password Management and Responsibilities

(1) Authorized users shall comply with the following rules to create and manage their passwords: (a) All user accounts shall be protected by use of a password. This password shall be generated by and known only to the individual user. (b) The Department of Corrections ISO shall determine password characteristics. (2) Password Duration: All user passwords shall be subject to automatic retirement at a maximum set time period in the standards and guidelines. Authorized users may change passwords as often as they wish during this period and are encouraged to do so. (3) Password Violation: Violation of these rules is a disciplinary matter with consequences up to and including dismissal. (4) A user account shall be automatically disabled when there have been more than five consecutive invalid logon attempts by a user during a 120-minute time period. (5) The Department of Corrections ISO or designee may re-enable a disabled password.