AO coverage. Addresses both Password Reuse objectives: the number of generations is specified, and reuse is prevented across them.

Specified generations. 24 for domain and IdP accounts, matching the domain policy default we chose to keep, and 24 on the Linux bastions via pam_pwhistory remember=24. The figure is written in the password standard, not just left as whatever the platform shipped.

Enforcement. Domain policy holds 24 hashes and pairs with a one-day minimum password age so a user cannot walk through history in one session. The bastions apply pwhistory in the system auth stack, which covers both console and SSH password changes. Vaulted shared credentials sidestep history entirely: rotation generates a random 32-character value, so reuse is structurally impossible.

Maintenance. Quarterly export of the effective policy from a domain-joined host and from each bastion. After OS or package upgrades, re-check that PAM configuration was not reverted by the package manager — this has bitten us once, so it is an explicit line item on the patch checklist.

Accepted gap. One network appliance stores only three password generations. Because its credential is vault-managed and rotated to a random value, history depth there is not load-bearing; the exception notes that compensating logic.

• Password standard specifying 24 generations and the minimum age
• Effective domain policy export from a member host
• pam_pwhistory configuration from both bastions
• Vault rotation policy and a recent rotation log for a shared appliance credential
• Patch checklist line item covering PAM configuration verification