Mapped to NIST 800-171 Requirement: 3.5.7
CMMC Assessment Objective: IA.L2-3.5.5[b]
What This Objective Means
Once your organization defines the characteristics of an acceptable password, you must ensure that all systems enforce those standards. This includes:
• System login settings (Windows, Linux, macOS)
• Identity providers (e.g., Microsoft Entra ID/Azure AD, Okta)
• Local applications, portals, or tools using internal login mechanisms
Passwords that don’t meet your defined standards must be rejected automatically.
Why It Matters
If password requirements are:
• Not technically enforced
• Left up to user discretion
• Implemented inconsistently across systems
…then your organization is open to credential compromise. Password policies must be enforced by technology, not just assumed.
How to Implement It
1. Enforce via Operating Systems
• Windows: Configure via Group Policy (GPO) or Local Security Policy
• Linux/macOS: Use PAM modules and password configuration files
2. Configure Your Identity Provider
• Azure AD, Okta, Google Workspace, etc. should enforce:
◦ Minimum length
◦ Complexity or banned password list
◦ Reuse prevention
3. Apply Across All Environments
• On-prem, cloud, VPN, SaaS tools, and third-party platforms
4. Enable Secure Password Reset and Creation Flows
• Users must be required to choose passwords that meet standards when resetting credentials
5. Periodically Review Enforcement
• Audit current settings across platforms
• Attempt to create a weak password to verify blocking behavior
Evidence the Assessor Will Look For
• System settings showing password policy enforcement
• GPO or IAM policy exports
• Password creation screens with real-time validation
• Screenshots rejecting weak passwords
• Logs of password creation and reset attempts
Common Gaps
• Password policy is defined but not enforced by the system
• Inconsistent settings between on-prem and cloud systems
• Older legacy systems with no password controls
• Users able to use weak or reused passwords during reset
How Cuick Trac Helps
Cuick Trac supports this control by:
• Automatically enforcing password policies across all systems in the enclave
• Requiring compliance with defined length, complexity, and strength rules
• Integrating with secure identity platforms that block weak or breached passwords
• Providing proof of enforcement through policy exports and system logs
• Preventing users from creating credentials that don’t meet your standard
With Cuick Trac, password enforcement isn’t optional—it’s built in.
Final CTA
Strong password policies only matter if they’re enforced.
Schedule a Cuick Trac demo to ensure your password rules are applied consistently—across every system.