AC.L2-3.1.8 Unsuccessful Logon Attempts

CMMC Practice AC.L2-3.1.8 – Unsuccessful Logon Attempts: Limit unsuccessful logon attempts.

Links to Publicly Available Resources

Discussion [NIST SP 800-171 R2]
This requirement applies regardless of whether the logon occurs via a local or network connection. Due to the potential for denial of service, automatic lockouts initiated by systems are, in most cases, temporary and automatically release after a predetermined period established by the organization (i.e., a delay algorithm). If a delay algorithm is selected, organizations may employ different algorithms for different system components based on the capabilities of the respective components. Responses to unsuccessful logon attempts may be implemented at the operating system and application levels.

Further Discussion
Consecutive unsuccessful logon attempts may indicate malicious activity. Contractors can mitigate these attacks by limiting the number of unsuccessful logon attempts, typically by locking the account. A defined number of consecutive unsuccessful logon attempts is a common configuration setting. Contractors are expected to set this number at a level that fits their risk profile with the knowledge that fewer unsuccessful attempts provide higher security.
After an unsuccessful login attempt threshold is exceeded and the system locks an account, the account may either remain locked until an administrator takes action to unlock it, or it may be locked for a predefined time after which it unlocks automatically.