IA.L2-3.5.10
Cryptographically-Protected Passwords
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee IA.L2-3.5.10 in the reference catalog with its NIST cross-references
Official requirement
Store and transmit only cryptographically-protected passwords.
Assessment objectives
a. passwords are cryptographically protected in storage; and
b. passwords are cryptographically protected in transit.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Protect stored and transmitted passwords with cryptography.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You are responsible for managing passwords for your organization. You protect all passwords with a one- way transformation, or hashing, before storing them. Passwords are never transmitted across a network unencrypted [a,b].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Identification and authentication policy; system security plan; procedures addressing authenticator management; procedures addressing user identification and authentication; system design documentation; list of system authenticator types; system configuration settings and associated documentation; change control records associated with managing system authenticators; system audit logs and records; other relevant documents or records
Common mistakes
Protecting password storage while transmitting passwords through an unprotected path.