IA.L2-3.5.8
Password Reuse
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee IA.L2-3.5.8 in the reference catalog with its NIST cross-references
Official requirement
Prohibit password reuse for a specified number of generations.
Assessment objectives
a. the number of generations during which a password cannot be reused is specified and
b. reuse of passwords is prohibited during the specified number of generations.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Prevent password reuse for the specified number of generations.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You explain in your company ’s security policy tha t changing passwords regularly provides increased security by reducing the ability of adversaries to exploit stolen or purchased passwords over an extended period. You define how often individuals can reuse their passwords and the minimum number of password generations before reuse [a]. If a user 112 NIST SP 800-171A, p. 34. 113 NIST SP 800-171 Rev. 2, p. 25. tries to reuse a password before the number of password generations has been exceeded, an error message is generated, and the user is required to enter a new password [b].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Identification and authentication policy; password policy; procedures addressing authenticator management; system security plan; system design documentation; system configuration settings and associated documentation; password configurations and associated documentation; other relevant documents or records
Common mistakes
Blocking only the immediately previous password when the policy requires a longer history.