Documentation for password complexity for access to tenant

Our auditors are asking for documentation regarding the password complexity for tenant members to access the dashboard, but I cant find this anywhere. Can someone please point me to this?