CMMC Practice Requirement:
Enforce a minimum password complexity and change of characters when new passwords are created.
CMMC Requirement Explanation:
By establishing and enforcing strong password requirements you make it more difficult for an attacker to crack your passwords.
Example CMMC Implementation:
Establish your password complexity requirements. For example an 8-character mix of upper case letters, lower case letters, numbers, and special characters, including at least one of each. Using the password history policy you establish for IA.2.079 you can force users to always use new characters when they set a new password.
Scenario(s):
- Scenario 1:
An user is having difficulty setting a new password. You go to assist him and discover that he is only using lowercase letters and numbers. You inform him of your password complexity requirements. The user successfully creates a password meeting your complexity requirements.
Discover Our NIST SP 800-171 Solutions:
Compliance Accelerator
For contractors seeking compliance
Quantum Assessor
For IT service providers
Supply Chain Verifier
For contractors seeking to verify partner compliance