ASVS V6.1.2 requires a documented list of context specific words that must not appear in passwords, such as your company name, product names, system identifiers, project codenames and department names, along with their common permutations. It is a Level 2 requirement.
Why it matters
Attackers build targeted wordlists from public information about the victim. A password like Acme2026! passes complexity rules and still falls in minutes.
How to implement it
Store the list as a reviewed file in version control so changes have an owner and a history.
# context-words.txt, reviewed by security each quarter
acme
acmecloud
projectfalcon
payroll
hrportal
Document the permutation rules next to it: case folding, leetspeak substitution (a to 4, e to 3), and trailing years or digits. Name an owner and a review date. V6.2.11 covers enforcing it at password creation.
Start by pulling names from your own sources: the company legal name, brand names, product and feature names, internal tool names, office locations, and team names from the org chart. Add public project codenames that have appeared in repositories or press. Remove words that are also very common English words unless the combination is risky, so you do not block half the dictionary.
How to test it
Open the file and confirm it includes your current product names and any codenames that appear in public repos or job posts. Then try to register with Acme2026 and confirm the later enforcement rejects it.
Ask a colleague outside the security team to try to guess five words that belong on the list. Anything they name that is missing is a gap. Repeat the exercise after each product launch or rebrand.
Common mistakes
-
A list created once and never updated after a rebrand.
-
Including only the exact company name.
-
Keeping the list in a wiki nobody owns.
-
Treating the list as secret. Assume attackers can rebuild most of it, so the point is to keep users away from it, not to hide it.
Quick check
Is this the same as a breached password check?
No. Breached lists are generic. This list holds words that are specific to your organization.
