Mapped to NIST 800-171 Requirement: 3.5.1
CMMC Assessment Objective: IA.L2-3.5.1[b]
What This Objective Means
This control ensures that all system accounts require a valid password to authenticate—not just in policy, but in technical enforcement.
It applies to:
• User accounts
• Administrator accounts
• Service or application accounts
You need to verify that these accounts cannot log in or access systems without a valid password, unless they are explicitly configured to use a stronger alternative (e.g., multi-factor authentication or certificate-based login).
Why It Matters
If an account does not require a password:
• It becomes a major vulnerability
• Attackers could gain access without any authentication
• Insider threats can escalate access or bypass login screens
• You could fail an audit—even if other controls are in place
Authentication requirements must be enforced at the system level—not assumed.
How to Implement It
1. Check Authentication Settings
• Review local and domain policy to confirm that passwords are required for login
• Use GPO or system security settings to enforce password authentication
2. Review System-Level Configurations
• Ensure password prompts are enabled for remote access, login sessions, or privilege elevation (e.g., sudo, RDP, SSH)
3. Disable or Correct Misconfigured Accounts
• Identify any accounts set to allow blank passwords or automatic logins
• Correct misconfigurations immediately
4. Test and Validate
• Attempt to log in using test accounts without a password to confirm access is blocked
• Review security audit logs for any successful logins that bypass authentication
5. Include Service Accounts
• Ensure automated accounts still authenticate with a password or key-based equivalent
Evidence the Assessor Will Look For
• System configurations enforcing password login (screenshots or exports)
• GPO or PAM module settings requiring authentication
• Logs showing password prompts for logins
• Documentation confirming that all accounts use password or stronger authentication methods
Common Gaps
• Some systems allow login without a password (e.g., kiosks, test servers)
• Remote access services allow blank passwords
• Shared or default credentials are reused across systems
• Password requirements are defined in policy but not enforced technically
How Cuick Trac Helps
Cuick Trac supports this control by:
• Enforcing mandatory password authentication for all system access within the enclave
• Blocking any accounts that attempt to connect without valid credentials
• Disabling systems from allowing null or blank passwords
• Providing customers with automated password policy enforcement and system audit capabilities
• Supporting secure authentication for service accounts with documented controls
With Cuick Trac, password authentication isn’t optional—it’s built-in and enforced by default.
Final CTA
Assumptions don’t stop attackers. Controls do.
Schedule a Cuick Trac demo and confirm that every account in your system is protected by enforced password authentication.