---
title: "Password Policy Expiration Too Weak – Non-Expiring Passwords"
description: "Impact Area Security Severity Medium Affected Element Profile ## Rule ID **SF-0108** ## Impact Weak password expiration policies can open you up to brute force and dictionary attacks. Non-expiring passwords are unsafe. ## Remediation Modify the password expiration time to…"
url: "https://community-staging.qualityclouds.com/qcdocs/qcr/rules/password-policy-expiration-too-weak-non-expiring-passwords/"
updated: "2025-03-21"
category: Rules
---

# Password Policy Expiration Too Weak – Non-Expiring Passwords

Impact Area       Security

Severity

Medium

           Affected Element

Profile

## Rule ID

**SF-0108**

## Impact

Weak password expiration policies can open you up to brute force and dictionary attacks. Non-expiring passwords are unsafe.

## Remediation

Modify the password expiration time to ninety days or less.

### Time to fix

30 min

## References

This rule is linked to [Common Weakness Enumeration CWE-521 Weak Password Requirements](https://cwe.mitre.org/data/definitions/521.html).