A set of rules that enforce strong password requirements and specifies how often users must change their passwords.