Unsuccessful Logon Attempts (03.01.08)_unsuccessful-logon-attempts

Unsuccessful Logon Attempts (03.01.08) Unsuccessful Logon Attempts

High-Level Description

Family: Access Control Framework: NIST SP 800-171 Rev 3 Applicability: Systems processing, storing, or transmitting CUI

Enforce a limit of [organization-defined] consecutive invalid logon attempts by a user during a [organization-defined]. Automatically [organization-defined] when the maximum number of unsuccessful attempts is exceeded.

What to Check

• Verify Unsuccessful Logon Attempts (03.01.08) Unsuccessful Logon Attempts is implemented for CUI systems
• Review SSP documentation for Unsuccessful Logon Attempts (03.01.08)
• Validate CMMC Level 2 assessment objective for Unsuccessful Logon Attempts (03.01.08)
• Confirm POA&M addresses any gaps for Unsuccessful Logon Attempts (03.01.08)

How to Test

Step 1: Review System Security Plan

Examine the SSP for Unsuccessful Logon Attempts (03.01.08) implementation description and responsible parties.

Step 2: Assess Implementation

# Verify security controls protecting CUI
# Check access controls, encryption, monitoring as applicable

# For Linux systems:
ls -la /etc/security/ 2>/dev/null
grep -r "CUI\|controlled" /etc/security/ 2>/dev/null

# For cloud:
# Use cloud-audit-mcp tools to assess posture

Step 3: CMMC Assessment Validation

Verify this requirement passes CMMC Level 2 assessment methodology per SP 800-171A Rev 3.

Tools

Remediation Guide

Requirement Statement

Enforce a limit of [organization-defined] consecutive invalid logon attempts by a user during a [organization-defined]. Automatically [organization-defined] when the maximum number of unsuccessful attempts is exceeded.

Supplemental Guidance

Due to the potential for denial of service, automatic system lockouts are in most cases, temporary and automatically release after a predetermined time period established by the organization (i.e., using a delay algorithm). Organizations may employ different delay algorithms for different system components based on the capabilities of the respective components. Responses to unsuccessful system logon attempts may be implemented at the system and application levels. Organization-defined actions that may be taken include prompting the user to answer a secret question in addition to the username and password, invoking a lockdown mode with limited user capabilities (instead of a full lockout), allowing users to only logon from specified Internet Protocol (IP) addresses, requiring a CAPTCHA to prevent automated attacks, or applying user profiles, such as location, time of day, IP address, device, or Media Access Control (MAC) address.

Risk Assessment

CWE Categories

References

• NIST SP 800-171 Rev 3
• NIST SP 800-171A Rev 3 (Assessment)
• CMMC Model Overview
• NIST OSCAL Content

Checklist

• SSP documents Unsuccessful Logon Attempts (03.01.08) implementation
• Evidence of operating effectiveness collected
• POA&M addresses any gaps
• CMMC assessment objective met
• Continuous monitoring active