During a security interview the auditor asks how administrator passwords on the backup appliance are controlled. The engineer's honest answer is 'we always pick strong ones'. What should the auditor have found in place instead?

Password control on infrastructure devices is a configured property, not a team habit: the appliance supports enforced password rules such as minimum length and character classes, and across the remaining local administrator accounts those rules plus a managed rotation and sealed-storage routine are what 'controlled' means in an audit. 'We pick strong ones' is unverifiable and evaporates with the next hire. The factory-default reliance fails because a hardening standard exists precisely to confirm what the default actually enforces under this deployment's profile - a control nobody can demonstrate in configuration cannot be audited, whatever the vendor intended. Directory inheritance is a plausible-sounding myth: local accounts authenticate against the appliance's own account database and do not absorb the directory's password policy, which is exactly why the surviving local credentials need explicit rules of their own. A runbook-only standard documents intent without enforcement - the auditor's real question is what stops a weak password from being set, and a PDF stops nothing. Exam caveat: rotation discipline pairs with emergency escrow - rotating a credential that nobody can reach during an incident manufactures a worse failure than the stale password it prevents. Operational check: show the configured password policy on the appliance, list the local accounts it governs, and demonstrate one rejected weak choice.