A policy that may be contained within the security policy that defines password requirements (length and types of characters) as well as the password change process.