NIST 800-171 3.5.8 (IA.L2-3.5.8): Password Reuse

What 3.5.8 means in practice

Users cannot cycle back to a recent password. Specify how many earlier passwords are remembered (24 is a common choice) and enforce it in every system that manages passwords, usually with a minimum password age so the history cannot be flushed in one sitting.

SPRS points and the CMMC POA&M

What an assessor checks for 3.5.8

NIST SP 800-171A gives 2 determination statements for 3.5.8, each found satisfied or other than satisfied. Determine if:

1. 3.5.8[a] the number of generations during which a password cannot be reused is specified.
2. 3.5.8[b] reuse of passwords is prohibited during the specified number of generations.

NIST SP 800-171A (June 2018), assessment objectives for 3.5.8

Evidence that shows 3.5.8 is met

• The specified number of remembered passwords.
• Password history settings in the identity provider and directories.
• The same settings in applications that keep their own passwords.

How PolicyCortex gathers the evidence

PolicyCortex reads this evidence with the collectors below, read only, and grades 3.5.8 from it. Each line says what the product checks.

• Okta: Policies. Checks that every active Okta password policy remembers at least 24 earlier passwords and keeps a new password for at least a day.
• AWS: IAM. Checks the AWS account password policy against a baseline that prevents reuse of the last 24 passwords.