`AC-07` Unsuccessful Logon Attempts

NIST SP 800-53 (controls) 5.1.1+u4
All changes in this version

first version loaded AC Low baseline Moderate baseline High baseline

Title

Unsuccessful Logon Attempts

Control

a. Enforce a limit of [Assignment: number] consecutive invalid logon attempts by a user during a [Assignment: time period] ; and
b. Automatically [Selection (one or more): lock the account or node for {{ insert: param, ac-07_odp.04 }} ; lock the account or node until released by an administrator; delay next logon prompt per {{ insert: param, ac-07_odp.05 }} ; notify system administrator; take other {{ insert: param, ac-07_odp.06 }} ] when the maximum number of unsuccessful attempts is exceeded.

Discussion

The need to limit unsuccessful logon attempts and take subsequent action when the maximum number of attempts is exceeded applies regardless of whether the logon occurs via a local or network connection. Due to the potential for denial of service, automatic lockouts initiated by systems are usually temporary and automatically release after a predetermined, organization-defined time period. If a delay algorithm is selected, organizations may employ different algorithms for different components of the system based on the capabilities of those components. Responses to unsuccessful logon attempts may be implemented at the operating system and the application levels. Organization-defined actions that may be taken when the number of allowed consecutive invalid logon attempts is exceeded include prompting the user to answer a secret question in addition to the username and password, invoking a lockdown mode with limited user capabilities (instead of full lockout), allowing users to only logon from specified Internet Protocol (IP) addresses, requiring a CAPTCHA to prevent automated attacks, or applying user profiles such as location, time of day, IP address, device, or Media Access Control (MAC) address. If automatic system lockout or execution of a delay algorithm is not implemented in support of the availability objective, organizations consider a combination of other actions to help prevent brute force attacks. In addition to the above, organizations can prompt users to respond to a secret question before the number of allowed unsuccessful logon attempts is exceeded. Automatically unlocking an account after a specified period of time is generally not permitted. However, exceptions may be required based on operational mission or need.

Parameters

ac-07_odp.01: number
ac-07_odp.02: time period
ac-07_odp.03: [lock the account or node for {{ insert: param, ac-07_odp.04 }} ; lock the account or node until released by an administrator; delay next logon prompt per {{ insert: param, ac-07_odp.05 }} ; notify system administrator; take other {{ insert: param, ac-07_odp.06 }} ]
ac-07_odp.04: time period
ac-07_odp.05: delay algorithm
ac-07_odp.06: action

Related controls

ac-2, ac-9, au-2, au-6, ia-5

STIG rules that implement this control 43

Apple iOS/iPadOS 26 V1R3

AIOS-26-006900 CAT II Apple iOS/iPadOS 26 must be configured to not allow more than 10 consecutive failed authentication attempts.

Apple iOS/iPadOS 27 V1R1

AIOS-27-006400 CAT II Apple iOS/iPadOS 27 (MOS) must be configured to not allow more than 10 consecutive failed authentication attempts.

Apple macOS 15 (Sequoia) V1R8

APPL-15-000022 CAT II The macOS system must limit consecutive failed login attempts to three.
APPL-15-000060 CAT II The macOS system must set account lockout time to 15 minutes.

Apple macOS 26 (Tahoe) V1R4

APPL-26-000022 CAT II The macOS system must limit consecutive failed login attempts to three.
APPL-26-000060 CAT II The macOS system must set account lockout time to 15 minutes.

Application Security and Development V6R5

APSC-DV-000530 CAT I The application must enforce the limit of three consecutive invalid logon attempts by a user during a 15 minute time period.
APSC-DV-000540 CAT II The application administrator must follow an approved process to unlock locked user accounts.

Canonical Ubuntu 22.04 LTS V2R10

UBTU-22-411045 CAT III Ubuntu 22.04 LTS must automatically lock an account until the locked account is released by an administrator when three unsuccessful logon attempts have been made.

Canonical Ubuntu 24.04 LTS V1R7

UBTU-24-200610 CAT III Ubuntu 24.04 LTS must automatically lock an account until the locked account is released by an administrator when three unsuccessful logon attempts have been made.

Cisco IOS XE Router NDM Y26M04

CISC-ND-000150 CAT II The Cisco router must be configured to enforce the limit of three consecutive invalid logon attempts, after which time it must lock out the user account from accessing the device for 15 minutes.

Google Android 16 COBO Y26M10

GOOG-16-006400 CAT II Google Android 16 must be configured to not allow more than 10 consecutive failed authentication attempts.

Google Android 17 COBO Y26M06

GOOG-17-005300 CAT II Google Android 17 must be configured to not allow more than 10 consecutive failed authentication attempts.

Microsoft Windows 11 V2R11

WN11-AC-000005 CAT II Windows 11 account lockout duration must be configured to 15 minutes or greater.
WN11-AC-000010 CAT II The number of allowed bad logon attempts must be configured to three or less.
WN11-AC-000015 CAT II The period of time before the bad logon counter is reset must be configured to 15 minutes.
WN11-SO-000075 CAT II The required legal notice must be configured to display before console logon.

Microsoft Windows Server 2022 V2R11

WN22-AC-000010 CAT II Windows Server 2022 account lockout duration must be configured to 15 minutes or greater.
WN22-AC-000020 CAT II Windows Server 2022 must have the number of allowed bad logon attempts configured to three or less.
WN22-AC-000030 CAT II Windows Server 2022 must have the period of time before the bad logon counter is reset configured to 15 minutes or greater.

Microsoft Windows Server 2025 V1R4

WN25-AC-000010 CAT II Windows Server 2025 account lockout duration must be configured to 15 minutes or greater.
WN25-AC-000020 CAT II Windows Server 2025 must have the number of allowed bad logon attempts configured to three or less.
WN25-AC-000030 CAT II Windows Server 2025 must have the period of time before the bad logon counter is reset configured to 15 minutes or greater.

Red Hat Enterprise Linux 10 V1R3

RHEL-10-500020 CAT II RHEL 10 must log username information when unsuccessful login attempts occur.
RHEL-10-600200 CAT II RHEL 10 must enforce a delay of at least four seconds between login prompts following a failed login attempt.
RHEL-10-600410 CAT II RHEL 10 must automatically lock an account when three unsuccessful login attempts occur.
RHEL-10-600415 CAT II RHEL 10 must automatically lock the root account until the root account is released by an administrator when three unsuccessful login attempts occur during a 15-minute time period.
RHEL-10-600420 CAT II RHEL 10 must automatically lock an account when three unsuccessful login attempts occur during a 15-minute time period.
RHEL-10-600425 CAT II RHEL 10 must maintain an account lock until the locked account is released by an administrator.
RHEL-10-600430 CAT II RHEL 10 must ensure account lockouts persist.
RHEL-10-600600 CAT II RHEL 10 must configure the use of the pam_faillock.so module in the "/etc/pam.d/system-auth" file.
RHEL-10-600610 CAT II RHEL 10 must configure the use of the pam_faillock.so module in the "/etc/pam.d/password-auth" file.
RHEL-10-700430 CAT II RHEL 10 must configure SELinux context type to allow the use of a nondefault faillock tally directory.

Red Hat Enterprise Linux 9 V2R10

RHEL-09-411075 CAT II RHEL 9 must automatically lock an account when three unsuccessful logon attempts occur.
RHEL-09-411080 CAT II RHEL 9 must automatically lock the root account until the root account is released by an administrator when three unsuccessful logon attempts occur during a 15-minute time period.
RHEL-09-411085 CAT II RHEL 9 must automatically lock an account when three unsuccessful logon attempts occur during a 15-minute time period.
RHEL-09-411090 CAT II RHEL 9 must maintain an account lock until the locked account is released by an administrator.
RHEL-09-411105 CAT II RHEL 9 must ensure account lockouts persist.
RHEL-09-412045 CAT II RHEL 9 must log username information when unsuccessful logon attempts occur.
RHEL-09-431020 CAT II RHEL 9 must configure SELinux context type to allow the use of a nondefault faillock tally directory.
RHEL-09-611030 CAT II RHEL 9 must configure the use of the pam_faillock.so module in the /etc/pam.d/system-auth file.
RHEL-09-611035 CAT II RHEL 9 must configure the use of the pam_faillock.so module in the /etc/pam.d/password-auth file.

Samsung Android 16 COBO Y26M10

KNOX-16-005300 CAT II Samsung Android must be configured to not allow more than 10 consecutive failed authentication attempts.

AC-07 Unsuccessful Logon Attempts