Assessment Objectives
In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:
- CFG-04.1_A01 the means of limiting unsuccessful logon attempts is defined.
Assessment rigor: 1
Origin: 171A_3.1.8[a] - CFG-04.1_A02 the defined means of limiting unsuccessful logon attempts is implemented.
Assessment rigor: 1
Origin: 171A_3.1.8[b] - CFG-04.1_A03 the number of consecutive invalid logon attempts by a user allowed during a time period is defined.
Assessment rigor: 1
Origin: 53A_R5_AC-07_ODP[01] 171A_R3_A.03.01.08.ODP[01] - CFG-04.1_A04 <A.03.01.08.ODP[03]: SELECTED PARAMETER VALUES> when the maximum number of unsuccessful attempts is exceeded.
Defined parameters: Select one or more: - lock the account or node for an at least 15- minute time period; - lock the account or node until released by an administrator and notify a system administrator
Assessment rigor: NIST 800-171
Origin: 53A_R5_AC-07b. 171A_R3_A.03.01.08.b - CFG-04.1_A05 the time period to which the number of consecutive invalid logon attempts by a user is limited is defined.
Assessment rigor: 2
Origin: 53A_R5_AC-07_ODP[02] 171A_R3_A.03.01.08.ODP[02] - CFG-04.1_A06 the time period for an account or node to be locked is defined (if selected).
Assessment rigor: 2
Origin: 53A_R5_AC-07_ODP[04] 171A_R3_A.03.01.08.ODP[04] - CFG-04.1_A07 delay algorithm for the next logon prompt is defined.
Assessment rigor: 3
Origin: 53A_R5_AC-07_ODP[05] - CFG-04.1_A08 other action to be taken when the maximum number of unsuccessful attempts is exceeded is defined.
Assessment rigor: 3
Origin: 53A_R5_AC-07_ODP[03] 53A_R5_AC-07_ODP[06] - CFG-04.1_A09 a limit of <A.03.01.08.ODP[01]: number> consecutive invalid logon attempts by a user during <A.03.01.08.ODP[02]: time period> is enforced.
Defined parameters: SDP values: [01] - at most five (5) [02] - period of five (5) minutes
Assessment rigor: NIST 800-171
Origin: 53A_R5_AC-07a. 171A_R3_A.03.01.08.a - CFG-04.1_A10 one or more of the following PARAMETER VALUES are selected: {the account or node is locked automatically for <A.03.01.08.ODP[04]: time period>; the account or node is locked automatically until released by an administrator; the next logon prompt is delayed automatically; the system administrator is notified automatically; other action is taken automatically}.
Defined parameters: at least 15- minute time period
Assessment rigor: NIST 800-171
Origin: 171A_R3_A.03.01.08.ODP[03]
Gekoppelde issues
| Koppelingstype | Issue |
|---|---|
| blocks | Account Lockout |
- Secure Controls Framework -
EN: GRCA includes the Secure Controls Framework® (SCF) content, © Secure Controls Framework Council, LLC, used under the Creative Commons Attribution-NoDerivatives 4.0 International Public License. SCF control numbers, names, descriptions and mappings appear exactly as published by the SCF Council – https://securecontrolsframework.com. GRCA may group or reorder SCF content for display, which does not change SCF content; the mappings are shown as links to the frameworks they name. Learn more at https://securecontrolsframework.com.
DE: GRCA enthält Inhalte des Secure Controls Framework® (SCF), © Secure Controls Framework Council, LLC, genutzt unter der Creative Commons Attribution-NoDerivatives 4.0 International Public License. Nummern, Namen, Beschreibungen und Zuordnungen der SCF-Controls erscheinen genau so, wie der SCF Council sie veröffentlicht – https://securecontrolsframework.com. GRCA gruppiert oder sortiert SCF-Inhalte für die Anzeige, ohne sie zu verändern; die Zuordnungen erscheinen als Verknüpfungen zu den genannten Regelwerken. Mehr unter https://securecontrolsframework.com.