387a49cb__Critical_Security_Control__16__Description
[ID #] CSC 16-8 [Category] Quick win [Description] 
Require that all non-administrator accounts have strong passwords that contain letters, numbers, and special characters, be changed at least every 90 days, have a minimal age of one day, and not be allowed to use the previous 15 passwords as a new password. These values can be adjusted based on the specific business needs of the organization.
SANS Institute - Critical Security Control: 16
Description