Some organizations buy password policy enforcement tools that handle one or some of these, but the most recent version of Enzoic for Active Directory can meet all the NIST criteria. The goal of this product is to allow IT to set it up and then just let it run. Organizations have unique needs, so the automated responses can be customized when compromised or weak passwords are found. Organizations can automatically force a password reset, disable the account, or send alerts to an admin, the IT helpdesk or the user. The organization can then select the appropriate automated action—ranging from prompting the user to change their password on some future login to instantly disabling the account.