Single on NIST SP 800-63B password rules, current revision

I used the current revision, NIST SP 800-63B-4 (https://pages.nist.gov/800-63-4/sp800-63b.html). Section 3.1.1.2, "Password Verifiers," covers all ten topics. I opened the page and copied every quote below from it. I didn't use the older Revision 3 page (https://pages.nist.gov/800-63-3/sp800-63b.html), which a search returned, because it has been replaced.

1. Single-factor minimum length (SHALL, 15 characters): Passwords used as the only factor must be at least 15 characters. Passwords used only as part of multi-factor authentication MAY be shorter, but must still be at least 8 characters.
2. Maximum length (SHOULD, 64 characters): Verifiers should allow passwords of at least 64 characters.
3. Composition rules (SHALL NOT): Verifiers and CSPs must not impose them.
4. Periodic change (SHALL NOT): They must not require it. They must, however, force a change if there is evidence that the password has been compromised.
5. Password hints (SHALL NOT): They must not let subscribers store a hint that an unauthenticated claimant can see.
6. Security questions (SHALL NOT): They must not prompt subscribers to use knowledge-based authentication or security questions when choosing a password.
7. Blocklist (SHALL): Verifiers must check every new or changed password against a blocklist of commonly used, expected or compromised passwords.
8. Password managers (SHALL): Verifiers must allow password managers and autofill. They SHOULD also allow pasting.
9. Salt length (SHALL, 32 bits): The salt must be at least 32 bits long.
10. Hashing scheme (SHOULD): Verifiers should use an approved scheme from the latest revision of SP 800-132. Salting and hashing passwords at all is a SHALL.

{"answers":[
{"topic":"single-factor-minimum-length","keyword":"SHALL","value":"15","quote":"Verifiers and CSPs SHALL require passwords that are used as a single-factor authentication mechanism to be a minimum of 15 characters in length.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"topic":"maximum-length","keyword":"SHOULD","value":"64","quote":"Verifiers and CSPs SHOULD permit a maximum password length of at least 64 characters.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"topic":"composition-rules","keyword":"SHALL NOT","value":null,"quote":"Verifiers and CSPs SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types) for passwords.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"topic":"periodic-change","keyword":"SHALL NOT","value":null,"quote":"Verifiers and CSPs SHALL NOT require subscribers to change passwords periodically.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"topic":"password-hints","keyword":"SHALL NOT","value":null,"quote":"Verifiers and CSPs SHALL NOT permit the subscriber to store a hint (e.g., a reminder of how the password was created) that is accessible to an unauthenticated claimant.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"topic":"security-questions","keyword":"SHALL NOT","value":null,"quote":"Verifiers and CSPs SHALL NOT prompt subscribers to use knowledge-based authentication (KBA) (e.g., “What was the name of your first pet?”) or security questions when choosing passwords.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"topic":"blocklist","keyword":"SHALL","value":null,"quote":"When processing a request to establish or change a password, verifiers SHALL compare the prospective secret against a blocklist that contains known commonly used, expected, or compromised passwords.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"topic":"password-managers","keyword":"SHALL","value":null,"quote":"Verifiers SHALL allow the use of password managers and autofill functionality.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"topic":"salt-length","keyword":"SHALL","value":"32","quote":"The salt SHALL be at least 32 bits in length and chosen to minimize salt value collisions among stored hashes (i.e., to prevent multiple subscriber accounts from having the same hashed password).","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"topic":"hashing-scheme","keyword":"SHOULD","value":null,"quote":"An approved password hashing scheme published in the latest revision of [SP800-132] or updated NIST guidelines on password hashing schemes SHOULD be used.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"}
]}