I have read:
- PCI DSS 1.2
- SOX 404
- AR 25-2
- ISO 27001
But only PCI DSS specifies a minimum password length.
Are there any other regulations that dictate password lengths for any industry?
NIST documents talk about the impacts of certain lengths and complexities [NIST SP 800-63b now provides guidance on password length]. OWASP, SANS, and others give their opinions on password minimums, but they couldn't be considered official.
Not looking for recommendations or impacts of various lengths, but actual regulations that require a certain length. For the purposes of this question, it doesn't even matter if the regulations are good or not, just some regulatory body saying that passwords must be at least a certain length.