AC.L2-3.1.8
Unsuccessful Logon Attempts
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee AC.L2-3.1.8 in the reference catalog with its NIST cross-references
Official requirement
Limit unsuccessful logon attempts.
Assessment objectives
a. the means of limiting unsuccessful logon attempts is defined; and
b. the defined means of limiting unsuccessful logon attempts is implemented.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Set and enforce limits on repeated unsuccessful login attempts.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You attempt to log on to your work computer, which stores CUI. You mistype your password three times in a row, and an error message is generated telling you the account is locked [b]. You call your IT help desk or system administrator to request assistance. The system administrator explains that the account is locked as a result of three unsuccessful logon attempts [a]. The administrator offers to unlock the account and notes that you can wait 30 minutes for the account to unlock automatically.
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Access control policy; procedures addressing un successful logon attempts; system security plan; system design documentation; system configuration settings and associated documentation; system audit logs and records; other relevant documents or records
Common mistakes
Defining a lockout policy without applying it to all relevant authentication paths.