Mapped to NIST 800-171 Requirement: 3.5.7
CMMC Assessment Objective: IA.L2-3.5.5[a]
What This Objective Means
This control is about setting a standard for password quality—and making sure that standard is clearly documented, understood, and enforced.
Organizations must define, at a minimum:
• Minimum password length
• Complexity requirements (e.g., uppercase/lowercase, numeric, special characters)
• Prohibited password types (e.g., common words, reused passwords, or dictionary phrases)
The goal is to prevent the use of weak or easily guessed passwords that could be compromised through brute force or credential stuffing attacks.
Why It Matters
Weak passwords are one of the most exploited attack vectors. If your organization:
• Allows short or simple passwords
• Doesn’t define enforcement rules
• Doesn’t block reused or common credentials
…then you’re vulnerable to even basic automated password attacks.
Defining password strength is the first step to protecting your accounts.
How to Implement It
1. Follow NIST Guidelines (SP 800-63B)
• Set a minimum password length (recommendation: 12–16 characters)
• Eliminate mandatory complexity if using longer passphrases
• Avoid periodic password expiration unless justified by risk
2. Define Rules Based on Risk Profile
• Enforce stronger requirements for privileged accounts
• Use dictionary checks to block common passwords
3. Include in Policy Documentation
• Clearly list password requirements in your:
◦ Access Control Policy
◦ System Security Plan (SSP)
◦ Employee onboarding documentation
4. Apply to All Password-Based Accounts
• User accounts
• Admin accounts
• Service and API accounts, if applicable
5. Make It Enforceable
• Systems must reject passwords that don’t meet your defined standard
Evidence the Assessor Will Look For
• Documentation defining acceptable password characteristics
• Password policy excerpts or access control policies
• Screenshots of enforcement settings in system configurations
• Examples of system prompts or rejections for weak passwords
Common Gaps
• Password requirements are vague or undocumented
• Complexity rules are outdated or overly rigid
• Enforcement varies between systems
• No minimum length or dictionary checks configured
How Cuick Trac Helps
Cuick Trac supports this requirement by:
• Requiring secure password standards across all user accounts in the enclave
• Enforcing minimum length and complexity automatically
• Blocking the use of known weak or compromised passwords
• Helping document and apply password requirements across all systems
• Supporting long passphrases and modern NIST-recommended best practices
With Cuick Trac, password security starts with the right definition—and ends with consistent enforcement.
Final CTA
Don’t just hope your users choose strong passwords—define what “strong” means.
Schedule a Cuick Trac demo to align your password rules with compliance and real-world security.