> So where are the global standards?
Here: http://en.wikipedia.org/wiki/Password_strength#NIST_Special_...
That formulate provides the only meaningful measure of a passwords strength: its entropy. NIST 800-63 is a (very conservative) formula for calculating it. Rules like "at least one numeric" are poor rules of thumb for the same thing.
That raises the question of "how much entropy do I need". That depends on how well guarded the password is. A four digit pin has an entropy of around 12 bits. By web standards it's an absurdly weak password, yet it has stood attacks for years. That's because it's guarded by a piece of hardware that only lets you have 3 guesses.
There are banks that only let me have a 6 character password - without upper case or special characters, which you apparently think is bad. But the bank is assuming they control the use of that password in the same way the pin is controlled. If that assumption is right it's a perfectly reasonable think to do.
The assumption is almost certainly wrong, but it probably doesn't matter. There has been a gang knocking over Russian banks by infiltrating their IT (ie hacking their infrastructure). If they've done that they also have access to the customers password data. But then it probably doesn't matter as the bank is hosed anyway. http://www.wsj.com/articles/new-report-says-computer-crimina...
The average web site isn't as secure as a bank. It has to assume the password database will leak. If it leaks the attacker gets unlimited tries at guessing each password, and number of guesses per second is limited purely by how much hardware they can afford. For example, if the password is protected by SHA256 + salt, spending US$30K lets you make 1 guess every 3 pico seconds. If want a password that can withstand such at attack for a year (ie, take a year on average to brute force), you need a password with 40 bits of entropy. Such a password will be around 60 characters long. However, if the web site puts some thought into how they store the password they can reduce it considerably: http://pbkdf2.sourceforge.net/ Sadly almost none do.
Lets tie this up. We've seen that a 12 bit password (a pin) can work well, yet a 20 character password stored on a regular web site will last around 10 seconds once the password database storing the password as a salted SHA256 hash leaks. These are wildly different numbers are not going to be easily encapsulated by the single standard you desire, mainly because difference between these two examples was _not_ how user chose them. It is in the way they are protected. That is where you should be focusing your efforts.
Besides, forcing users to change their behaviour doesn't work - they are far smarter than your "weak password detection" algorithms, and none of us like to be manipulated.