Identify the documented procedures for issuing first-time passwords for new users, and confirm the procedures require:
i. First-time passwords must be set to a unique value for each user.
ii. First-time passwords must be changed after the first use.
Describe how security personnel responsible for assigning first-time passwords were observed to:
i. Set first-time passwords to a unique value for each new user.
ii. Set first-time passwords to be changed after first use.
Identify the documented procedures for resetting passwords for existing users, and confirm the procedures require:
i. Reset passwords must be set to a unique value for each user.
ii. Reset passwords must be changed after the first use.
Describe how security personnel responsible for resetting passwords were observed to:
i. Set reset passwords to a unique value for each existing user.
ii. Set reset passwords to be changed after first use.