Reference: CMMC v2.11
Family: IA
Level Introduced: 2
Title: Temporary Passwords
Practice:
Allow temporary password use for system logons with an immediate change to a permanent password.
Further Discussion:
Users must change their temporary passwords the first time they log in. Temporary passwords often follow a consistent style within an organization and can be more easily guessed than passwords created by the unique user. This approach to temporary passwords should be avoided.
Example
One of your duties as a systems administrator is to create accounts for new users. You configure all systems with user accounts to require users to change a temporary password upon initial login to a permanent password [a]. When a user logs on for the first time, they are prompted to create a unique password that meets all of the defined complexity rules.
Potential Assessment Considerations
• Are temporary passwords only valid to allow a user to perform a password reset [a]?
• Does the system enforce an immediate password change after logon when a temporary password is issued [a]?
Implementation Strategies
This is for registered users only. Please sign up for a free account, or Login, to see complete cross references to other standards and frameworks.
800-171 Requirements v2 (1)
This is for registered users only. Please sign up for a free account, or Login, to see complete cross references to other standards and frameworks.