STIGhubSTIGhub
STIGsRMF ControlsCompare
STIGhub— A free STIG search and compliance tool·STIGs updated 3 days ago
Powered by Pylon·Privacy·Terms·© 2026 Beacon Cloud Solutions, Inc.
← All Controls

AC-7

Access ControlRev 5system

Unsuccessful Logon Attempts

Baselines:LowModerateHigh

Control Statement

a. Enforce a limit of [Assignment: number] consecutive invalid logon attempts by a user during a [Assignment: time period] ; and b. Automatically [Selection: organization-defined value] when the maximum number of unsuccessful attempts is exceeded.

Supplemental Guidance

The need to limit unsuccessful logon attempts and take subsequent action when the maximum number of attempts is exceeded applies regardless of whether the logon occurs via a local or network connection. Due to the potential for denial of service, automatic lockouts initiated by systems are usually temporary and automatically release after a predetermined, organization-defined time period. If a delay algorithm is selected, organizations may employ different algorithms for different components of the system based on the capabilities of those components. Responses to unsuccessful logon attempts may be implemented at the operating system and the application levels. Organization-defined actions that may be taken when the number of allowed consecutive invalid logon attempts is exceeded include prompting the user to answer a secret question in addition to the username and password, invoking a lockdown mode with limited user capabilities (instead of full lockout), allowing users to only logon from specified Internet Protocol (IP) addresses, requiring a CAPTCHA to prevent automated attacks, or applying user profiles such as location, time of day, IP address, device, or Media Access Control (MAC) address. If automatic system lockout or execution of a delay algorithm is not implemented in support of the availability objective, organizations consider a combination of other actions to help prevent brute force attacks. In addition to the above, organizations can prompt users to respond to a secret question before the number of allowed unsuccessful logon attempts is exceeded. Automatically unlocking an account after a specified period of time is generally not permitted. However, exceptions may be required based on operational mission or need.

Related Controls (5)

AC-2AC-9AU-2AU-6IA-5

CCI Identifiers (10)

CCI-000043Defines the maximum number of consecutive invalid logon attempts to the information system by a user during an organization-defined time period.CCI-000044Enforce the organization-defined limit of consecutive invalid logon attempts by a user during the organization-defined time period.CCI-000045The organization defines in the security plan, explicitly or by reference, the time period for lock out mode or delay period.CCI-000046The organization selects either a lock out mode for the organization-defined time period or delays the next login prompt for the organization-defined delay period for information system responses to consecutive invalid access attempts.CCI-000047The information system delays next login prompt according to the organization-defined delay algorithm, when the maximum number of unsuccessful attempts is exceeded, automatically locks the account/node for an organization-defined time period or locks the account/node until released by an Administrator IAW organizational policy.CCI-001423Defines the time period in which the organization-defined maximum number of consecutive invalid logon attempts occur.CCI-001452The information system enforces the organization-defined time period during which the limit of consecutive invalid access attempts by a user is counted.

Linked STIG Checks (200)

Across 118 STIGs. Click to expand.

CCI-002236Defines the time period the information system will automatically lock the account or node when the maximum number of unsuccessful logon attempts is exceeded.
CCI-002237Defines the delay algorithm to delay the next logon prompt when the maximum number of unsuccessful logon attempts is exceeded.
CCI-002238Automatically lock the account or node for either an organization-defined time period, until the locked account or node is released by an administrator, or delays the next logon prompt according to the organization-defined delay algorithm when the maximum number of unsuccessful logon attempts is exceeded.