An internal auditing team would like to strengthen the password policy to support special characters. Which of the following types of password controls would achieve this goal?

Reverse encryption is not a recognized password control and would not introduce or enforce special character requirements in a password policy.

Password complexity is a security control that enforces rules requiring passwords to contain multiple character categories, including special characters such as !, @, #, and $. Enabling complexity requirements directly addresses the auditing team's goal of supporting special characters in passwords. NIST SP 800-63B and most password policy frameworks define complexity enforcement as a core password strength mechanism.

Increasing password length improves entropy but does not by itself require or enable the use of special characters.

Single sign-on is an authentication convenience mechanism that reduces the number of credentials a user manages but does not enforce password character composition rules.