I have read:
- PCI DSS 1.2
- SOX 404
- AR 25-2
- ISO 27001
But only PCI DSS specifies a minimum password length.
Are there any other regulations that dictate password lengths for any industry?
NIST documents talk about the impacts of certain lengths and complexities. OWASP, SANS, and others give their opinions on password minimums, but they couldn't be considered official.
Not looking for recommendations or impacts of various lengths, but actual regulations that require a certain length. For the purposes of this question, it doesn't even matter if the regulations are good or not, just some regulatory body saying that passwords must be at least a certain length.