3.1.8 — Lock After Failed Logins
What It Says
Section titled “What It Says”Limit unsuccessful logon attempts.
What It Actually Means
Section titled “What It Actually Means”Straightforward: after a defined number of failed login attempts, the account locks. The attacker can’t keep guessing.
Three decisions to make:
- How many attempts? 3-5 is standard
- How long is the lockout? 15-30 minutes, or until an admin unlocks it
- Does it apply everywhere? Workstations, VPN, cloud apps, remote desktop — all of them
The key word is everywhere. If lockout is configured on Active Directory but not on VPN or cloud apps, you have a gap.
Pass or Fail
Section titled “Pass or Fail”Your assessor needs a “yes” to every row:
| # | Question | What “yes” looks like |
|---|---|---|
| 1 | Is a lockout threshold defined? | A documented number of failed attempts that triggers lockout |
| 2 | Is the lockout implemented? | The system actually locks accounts — across all access methods |
What to Have Ready on Assessment Day
Section titled “What to Have Ready on Assessment Day”Documents they’ll review: Access control policy, unsuccessful logon procedures, system security plan, system configuration settings, audit logs showing lockout events
People they’ll talk to: Information security staff, system developers, sysadmins
Live demos they’ll ask for: “Type the wrong password [X] times in a row — show me the account locks.”
The Assessor’s Playbook
Section titled “The Assessor’s Playbook”These are the actual questions. Have answers ready.
- “What is your defined threshold for unsuccessful logon attempts?”
- “Is the lockout mechanism implemented and does it use the defined threshold?”
- “Does the lockout apply to all access methods — local, remote, VPN, cloud?”
- “Show me the configuration setting.”
Where Companies Trip Up
Section titled “Where Companies Trip Up”Inconsistent across systems. Lockout on AD but not on VPN, cloud apps, or local accounts.
No lockout at all. Some systems default to unlimited attempts. Check every system.
Threshold too high. 20 failed attempts before lockout gives attackers 20 password guesses.
How to Talk About This
Section titled “How to Talk About This”Connected Requirements
Section titled “Connected Requirements”| Requirement | Why it matters here |
|---|---|
| 3.1.1 — Who Gets In | Foundational access control |
| 3.5.3 — Multifactor Auth | MFA makes brute-force much harder even without lockout |
Implementation
Section titled “Implementation”Step-by-step guides for Microsoft 365, AWS, Azure, and GCP are available to Ancitus clients.
Start a conversation →CMMC Practice ID: AC.L2-3.1.8 | SPRS Weight: 1 point | POA&M Eligible: Yes