IA.L2-3.5.9
Temporary Passwords
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee IA.L2-3.5.9 in the reference catalog with its NIST cross-references
Official requirement
Allow temporary password use for system logons with an immediate change to a permanent password.
Assessment objectives
a. an immediate change to a permanent password is required when a temporary password is used for system logon.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Allow temporary passwords only with a required immediate change to a permanent password.
Implementation example
Example from the source assessment guide (not a mandatory implementation): One of your duties as a systems administrator is to create accounts for new users. You configure all systems with user accounts to require users to change a temporary password upon initial login to a permanent password [a]. When a user logs on for the first tim e, they are prompted to create a unique password that meets all of the defined complexity rules.
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Identification and authentication policy; password policy; procedures addressing authenticator management; system security plan; system configuration settings and associated documentation; system design documentation; password configurations and associated documentation; other relevant documents or records
Common mistakes
Leaving a temporary password usable indefinitely or allowing ordinary work before its change.