Password security options have been added to the default ctsrvr.cfg file. These options are commented such they do not affect your configuration. They are easily enabled by removing the semicolon (";") at the beginning of the initial SUBSYSYEM line:
;SUBSYSTEM SECURITY PASSWORD {
MINIMUM_LENGTH 8
REQUIRED_CLASSES 3
EXPIRE_IN_DAYS 180
}