I'd add 'not in the 10,000 most common passwords' to that requirement.