AC.L2-3.1.8  

Reference: CMMC v2.13

Family: AC

Level Introduced: 2

Title: Unsuccessful Logon Attempts

Practice:
Limit unsuccessful logon attempts.

Further Discussion:
Consecutive unsuccessful logon attempts may indicate malicious activity. OSAs can mitigate these attacks by limiting the number of unsuccessful logon attempts, typically by locking the account. A defined number of consecutive unsuccessful logon attempts is a common configuration setting. OSAs are expected to set this number at a level that fits their risk profile with the knowledge that fewer unsuccessful attempts provide higher security.

After an unsuccessful login attempt threshold is exceeded and the system locks an account, the account may either remain locked until an administrator takes action to unlock it, or it may be locked for a predefined time after which it unlocks automatically.

Example
You attempt to log on to your work computer, which stores CUI. You mistype your password three times in a row, and an error message is generated telling you the account is locked [b]. You call your IT help desk or system administrator to request assistance. The system administrator explains that the account is locked as a result of three unsuccessful logon attempts [a]. The administrator offers to unlock the account and notes that you can wait 30 minutes for the account to unlock automatically.

Potential Assessment Considerations
• Is there a defined threshold for the number of unsuccessful logon attempts for which the system takes action to prevent additional attempts [a]?
• Is a mechanism for limiting the number of unsuccessful logon attempts implemented and does it use the defined threshold [b]?

Source: CMMC v2.13