NIST 800-171 3.1.8 (AC.L2-3.1.8): Unsuccessful Logons

What 3.1.8 means in practice

Repeated wrong passwords should trigger a lockout or a growing delay, so passwords cannot be guessed at speed. Choose the threshold and the lockout period, write them down, and set them wherever people sign in: the identity provider, servers, network devices and applications with their own logins.

SPRS points and the CMMC POA&M

What an assessor checks for 3.1.8

NIST SP 800-171A gives 2 determination statements for 3.1.8, each found satisfied or other than satisfied. Determine if:

1. 3.1.8[a] the means of limiting unsuccessful logon attempts is defined.
2. 3.1.8[b] the defined means of limiting unsuccessful logon attempts is implemented.

NIST SP 800-171A (June 2018), assessment objectives for 3.1.8

Evidence that shows 3.1.8 is met

• The documented lockout threshold and lockout duration.
• Identity provider lockout settings, such as Microsoft Entra smart lockout or an Okta password policy.
• Group Policy or device settings that apply the same limit on servers and workstations.
• Logs showing an account locked after repeated failures.

How PolicyCortex gathers the evidence

PolicyCortex reads this evidence with the collectors below, read only, and grades 3.1.8 from it. Each line says what the product checks.

• Microsoft Entra ID: Smart lockout. Checks that Microsoft Entra smart lockout is configured to limit unsuccessful sign-in attempts.
• Okta: Policies. Checks that every active Okta password policy locks an account after at most 10 failed attempts, for at least 15 minutes.