• numbers, and
• special characters <e>, @, #;, $, and </e>.
• repeating letters or numbers (such as aa, DD, or 22),
• common words and abbreviations, or
• any portion of the user ID.
• change their passwords at least every 90 days and
• not reuse their last three passwords and current password.