To ensure compliance with a security policy requiring that passwords be a combination of letters and numbers, an IS auditor should recommend that: