IA.L2-3.5.11
Obscure Feedback
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee IA.L2-3.5.11 in the reference catalog with its NIST cross-references
Official requirement
Obscure feedback of authentication information.
Assessment objectives
a. authentication information is obscured during the authentication process.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Obscure authentication feedback so it does not reveal sensitive authentication information.
Implementation example
Example from the source assessment guide (not a mandatory implementation): As a system administrator, you configure your systems to display an asterisk when users enter their passwords into a computer system [a]. For mobile devices, the password characters are briefly displayed to the user before being obscured. This prevents people from figuring out passwords by looking over someone’s shoulder.
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Identification and authentication policy; procedures addressing authenticator feedback; system security plan; system design documentation; system configuration settings and associated documentation; system audit logs and records; other relevant documents or records
Common mistakes
Displaying authentication secrets in a form, diagnostic message, or screen output.