This objective ensures that your systems are technically configured to enforce the password characteristics defined in IA.L2-3.5.5[a]—such as minimum length, complexity, and blocking of weak passwords. It confirms that enforcement is happening at the system level, not just documented in policy.