There's a relevant (and pretty funny) ServerFault question from 2011 I'm immediately reminded of:

"Our Security Auditor Is An Idiot. How Do I Give Him The Information He Wants?" http://serverfault.com/questions/293217/our-security-auditor...

An eight and only eight character password? Less security than a social network, all aboard the American banking system!

"Privacy is PCI-DSS compliant. We are held to the same rigorous security standards as your bank."

Hey, us too!

http://www.rsync.net/resources/regulatory/pci.html

Cheers!

My bank's security is a password that is a maximum of 8 characters, no symbols allowed. Seems rigorous.