8.3.5 If passwords/passphrases are used as authentication factors to meet Requirement 8.3.1, they are set and reset for each user as follows: • Set to a unique value for first-time use and upon reset. •
If passwords/passphrases are used as authentication factors to meet Requirement 8.3.1, they are set and reset for each user as follows: • Set to a unique value for first-time use and upon reset. •.
system holds itEvidence a system already holds
- Configuration forcing a change immediately after first use · Identity provider / directory
- Records or configuration showing the delivery method for the initial value · Identity provider / directory
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- Procedures for setting and resetting passwords or passphrases · Policy repository / GRC workspace
- Evidence each initial and reset value is set to a unique value rather than a standard or predictable one · Policy repository / GRC workspace
- Observation of security personnel performing a reset, showing both elements applied · Policy repository / GRC workspace
First move
Common gaps auditors find
- A standard welcome password used for all new accounts, which fails the unique value element
- Forced change on first use not enforced technically, so the initial value can persist
- Initial value delivered in the same message as the user ID over an unprotected channel
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet8.3.4 Invalid authentication attempts are limited by: • Locking out the user ID after not more than 10 attempts. • Setting the lockout duration to a minimum of 30 minutes or until the user's identity · 8.3.6 If passwords/passphrases are used as authentication factors to meet Requirement 8.3.1, they meet the following minimum level of complexity: • A minimum length of 12 characters (or IF the system does not support 12