not too similar to your other personal information, not a commonly used password, not entirely numeric, and at least 8 characters.