The IBM RACF PASSWORD(HISTORY) SETROPTS value must be set to five or more.

Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. HISTORY specifies the number of previous passwords that RACF saves for each USERID and compares with an intended new password. If there is a match with one of the previous passwords, or with the current password, RACF rejects the intended new password.

From the ISPF Command Shell enter: SETRopts List

If the PASSWORD(HISTORY) value is set properly then the message x GENERATIONS OF PREVIOUS PASSWORDS BEING MAINTAINED, where x is a minimum of "5", this is not a finding.

Configure the PASSWORD(HISTORY) SETROPTS value is set to a minimum of "5". This specifies the number of previous passwords that RACF saves for each USERID and compares with an intended new password. If there is a match with one of the previous passwords, or with the current password, RACF rejects the intended new password.

Evaluate the impact associated with implementation of the control option. Develop a plan of action to implement the control option as specified in the example below:

The RACF Command SETR LIST will show the status of RACF Controls including PASSWORD HISTORY.

Setting the password history to 10 generations is activated with the command SETR PASSWORD(HISTORY(10)).