AC-7 Unsuccessful logon attempts
Requires a limit on consecutive failed logon attempts within a defined time period, and an automatic response when the limit is passed, such as locking the account or node for a defined period, holding it until an admini
4
artefacts
1
held by a system
1
at each review
moderate
to go live
Identity provider / directory
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Sample account lockout events from authentication logs · Identity provider / directory
periodic reviewEvidence produced at each review
- Coverage evidence across all authentication surfaces including remote and application logins · Identity provider / directory
governing documentDocuments that govern the control
- Authentication policy configuration showing threshold, counting window and lockout response · Policy repository / GRC workspace
- Documented values chosen for attempt count, time period and lockout duration · Policy repository / GRC workspace
First move
Start with the 1 of 4 artefacts that already live in a system (Identity provider / directory); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Threshold enforced on the directory but not on the internet facing application login
- Lockout response set to notify only, so brute force attempts continue unimpeded
- Values never formally defined, leaving defaults that nobody has reviewed
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetAC-6 Least privilege · AC-8 System Use Notification. Display [organization-defined] to users before granting access to the system that provides privacy and security notices consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines and state that: