After T94774, we can define password policies based on group membership.
Users in the Staff group (https://meta.wikimedia.org/wiki/Special:GlobalUsers/staff) have access to checkuser data and interface editing globally. An account compromise could have a significant impact on the sites availability (adding slow/harmful javascript to the site), user privacy (checkuser, adding tracking code to the interface), and reputation (deliver browser exploits from our sites).
My proposal is setting an 8-byte minimum length (users will be prompted to change their password on login) in the near term, and then require 8-byte minimum passwords to login after users have had time to update their passwords.