While reviewing the security controls in place for a web-based application, a security controls assessor notices that there are no password strength requirement...