If the entity being assessed is a service provider:
Identify the customer/user documentation that requires non-consumer user passwords to use both numeric and alphabetic characters.
Describe how the observed processes confirm that non-consumer user passwords contain both numeric and alphabetic characters.