diff --git a/capabilities-map.yaml b/capabilities-map.yaml
index ae747621b4..085570e624 100644
--- a/capabilities-map.yaml
+++ b/capabilities-map.yaml
@@ -504,3 +504,15 @@ topics:
             description:
             requires:
               - overcloud-resource-registry-puppet.yaml
+
+  - title: Security Options
+    description: Security Hardening Options
+    environment_groups:
+      - title: Horizon Password Validation
+        description: Enable Horizon Password validation
+        environments:
+          - file: environments/horizon_password_validation.yaml
+            title: Horizon Password Validation
+            description:
+            requires:
+              - overcloud-resource-registry-puppet.yaml
diff --git a/environments/horizon_password_validation.yaml b/environments/horizon_password_validation.yaml
new file mode 100644
index 0000000000..1a0f92ccd2
--- /dev/null
+++ b/environments/horizon_password_validation.yaml
@@ -0,0 +1,5 @@
+# Use this enviroment to pass in validation regex for horizons password
+# validation checks
+parameter_defaults:
+  HorizonPasswordValidator: '.*'
+  HorizonPasswordValidatorHelp: 'Your password does not meet the requirements.'
diff --git a/puppet/services/horizon.yaml b/puppet/services/horizon.yaml
index e59dc202ed..f31ca17cb5 100644
--- a/puppet/services/horizon.yaml
+++ b/puppet/services/horizon.yaml
@@ -27,6 +27,14 @@ parameters:
     description: A list of IP/Hostname for the server Horizon is running on.
                  Used for header checks.
     type: comma_delimited_list
+  HorizonPasswordValidator:
+    description: Regex for password validation
+    type: string
+    default: ''
+  HorizonPasswordValidatorHelp:
+    description: Help text for password validation
+    type: string
+    default: ''
   HorizonSecret:
     description: Secret key for Django
     type: string
@@ -70,6 +78,8 @@ outputs:
             options: ['FollowSymLinks','MultiViews']
           horizon::bind_address: {get_param: [ServiceNetMap, HorizonNetwork]}
           horizon::keystone_url: {get_param: [EndpointMap, KeystoneInternal, uri]}
+          horizon::password_validator: {get_param: [HorizonPasswordValidator]}
+          horizon::password_validator_help: {get_param: [HorizonPasswordValidatorHelp]}
           horizon::secret_key:
             yaql:
               expression: $.data.passwords.where($ != '').first()