Lower level requirement for 6.4.6

Level 3 seems too high for this.

It is unfortunately not uncommon for admins to set trivial temporary passwords as a form of manual password reset, particularly in customer support and similar contexts. Additionally, some users are not receptive of good security practices and will put pressure on support agents to break policies (such as by setting a specific password for them), while support agents themselves are often incentivised to close tickets fast and have poor discipline as a result. This makes set-password-by-admin functionality very tempting to abuse.
Because it's an admin override, also it's not uncommon for set-password-by-admin functionality to ignore other policies that should serve as mitigations.

The combination of these factors makes it a high-risk feature. Requiring that all level 3 apps should have reset-by-admin is reasonable, but that shouldn't lower the bar for how securely the feature is designed at lower levels. Perhaps the requirement should be split in two?

Start with requirement 6.4.6 in the ASVS text and review how its current Level 3 placement relates to the password-reset and admin-set-password concerns described here. Compare the proposed lower level and possible split against the surrounding requirements; done means an agreed requirement structure and level, not just an implementation change.