What are the basic system security measures that all system must meet, regardless of their System classification?

The basic system security measures that all systems must meet, regardless of the level of their System Classification are as under: Password Protection: All accounts and resources must be protected by passwords which meet the following requirements, which must be automatically enforced by the system: Must be at least eight characters long. Must NOT be dictionary or common slang words in any language, or be readily guessable. Must include at least three of the following four characteristics, in any order: upper case letters, lower case letters, numbers, and special characters, such as *!@#\$%^&*. Must be changed at least once per year. Software Updates: Systems must be configured to automatically update operating system software, server applications, client software, and malware protection software. For Medium or High Availability systems, a plan to manually apply new updates within a documented time period is an acceptable alternative. Firewall: Systems must be protected by a firewall that allows only those incoming connections necessary to fulfill the business need of that system. Client systems which have no business need to provide network services must deny all incoming connections. Systems that provide network services must limit access to those services to the smallest reasonably manageable group of hosts that need to reach them. Malware Protection: Systems running Microsoft or Apple operating systems must have antivirus and anti-spyware software installed and it must be configured to automatically scan and update.