AP7.4.2. In conjunction with subparagraph AP22.214.171.124., above, a
personal identification number (PIN) may be required. The PIN must be
separately entered into the system by each individual using a keypad device
and shall consist of four or more digits, randomly selected, with no known or
logical association with the individual. The PIN must be changed when it is
believed to have been compromised or subjected to compromise.