ISO 27001 does not specify a password length but to ensure password security, use a password that is at least eight characters long.