8.3.4 Invalid authentication attempts are limited by: • Locking out the user ID after not more than 10 attempts. • Setting the lockout duration to a minimum of 30 minutes or until the user's identity
Invalid authentication attempts are limited by: • Locking out the user ID after not more than 10 attempts. • Setting the lockout duration to a minimum of 30 minutes or until the user's identity.
5
artefacts
2
held by a system
1
at each review
moderate
to go live
Identity provider / directory
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- System configuration settings showing lockout after not more than 10 invalid authentication attempts · Identity provider / directory
- Test or log evidence showing lockout actually occurs · Identity provider / directory
periodic reviewEvidence produced at each review
- System configuration showing lockout duration of at least 30 minutes, or lockout until identity is confirmed · Identity provider / directory
governing documentDocuments that govern the control
- Evidence the settings apply across all in scope components, including those with their own local authentication · Policy repository / GRC workspace
- The process for confirming identity where lockout is released by an administrator · Policy repository / GRC workspace
First move
Start with the 2 of 5 artefacts that already live in a system (Identity provider / directory); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Lockout configured in the directory while applications with local authentication have no limit
- Threshold or duration relaxed for administrative accounts to avoid operational disruption
- Lockout applied per component, so an attacker spreading attempts across systems never trips it
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet8.3.3 User identity is verified before modifying any authentication factor · 8.3.5 If passwords/passphrases are used as authentication factors to meet Requirement 8.3.1, they are set and reset for each user as follows: • Set to a unique value for first-time use and upon reset. •