Yes, for a complex password 9 is sufficient. If no complexity requirement is specified, 12 is sufficient. Additionally, if its Top Secret material (which is wont be for us) then it must be 15. I don't personally think 9 is enough, even if its complex, but thats the requirement.