AC-7 — Unsuccessful Logon Attempts

Official NIST control content

Control statement

a.Enforce a limit of [Organization-defined: number] consecutive invalid logon attempts by a user during a [Organization-defined: time period] ; and
b.Automatically [Organization-defined: ac-07_odp.03] when the maximum number of unsuccessful attempts is exceeded.

Official NIST discussion

Discussion

The need to limit unsuccessful logon attempts and take subsequent action when the maximum number of attempts is exceeded applies regardless of whether the logon occurs via a local or network connection. Due to the potential for denial of service, automatic lockouts initiated by systems are usually temporary and automatically release after a predetermined, organization-defined time period. If a delay algorithm is selected, organizations may employ different algorithms for different components of the system based on the capabilities of those components. Responses to unsuccessful logon attempts may be implemented at the operating system and the application levels. Organization-defined actions that may be taken when the number of allowed consecutive invalid logon attempts is exceeded include prompting the user to answer a secret question in addition to the username and password, invoking a lockdown mode with limited user capabilities (instead of full lockout), allowing users to only logon from specified Internet Protocol (IP) addresses, requiring a CAPTCHA to prevent automated attacks, or applying user profiles such as location, time of day, IP address, device, or Media Access Control (MAC) address. If automatic system lockout or execution of a delay algorithm is not implemented in support of the availability objective, organizations consider a combination of other actions to help prevent brute force attacks. In addition to the above, organizations can prompt users to respond to a secret question before the number of allowed unsuccessful logon attempts is exceeded. Automatically unlocking an account after a specified period of time is generally not permitted. However, exceptions may be required based on operational mission or need.

Official OSCAL parameters

Organization-defined parameters

These values must be resolved through the organization’s tailoring and governance process. Bracketed parameter references in the control text identify where a decision is required.

numberthe number of consecutive invalid logon attempts by a user allowed during a time period is defined;

time periodthe time period to which the number of consecutive invalid logon attempts by a user is limited is defined;

ac-07_odp.03

time periodtime period for an account or node to be locked is defined (if selected);

delay algorithmdelay algorithm for the next logon prompt is defined (if selected);

actionother action to be taken when the maximum number of unsuccessful attempts is exceeded is defined (if selected);

Original Bare Metal Cyber perspective

From control text to operational evidence

Use Unsuccessful Logon Attempts as a testable risk decision. Translate the official statement into accountable people, repeatable processes, configured technology, and evidence that demonstrates the outcome over time. In this family, pay particular attention to identity, authorization, least privilege, session boundaries, and access lifecycle governance.

Implementation workflow

Define the control boundary, responsible owner, inherited portions, and systems or processes in scope.
Resolve each organization-defined parameter before declaring the control implemented.
Document how the implementation satisfies every clause of the official control statement.
Collect evidence as a normal byproduct of operation rather than only before an assessment.
Review exceptions, changes, and monitoring results on a risk-based cadence.

Evidence examples

access approvals and entitlement records
role and group configuration exports
periodic access review results
authentication and authorization logs

Common failure patterns

standing privileges that outlive business need
shared or orphaned accounts
access rules implemented differently across systems
approvals that cannot be traced to actual permissions

Questions practitioners should ask

What risk decision is this control intended to support in this system?
Which parts are implemented locally, inherited, shared, or not applicable—and what evidence supports that decision?
Do the documented narrative, deployed configuration, operating process, and collected evidence agree?
What event or threshold requires the implementation to be reviewed or changed?

Official NIST SP 800-53A content

Assessment objectives and methods

Show the assessment objective

AC-07a.a limit of [Organization-defined: number] consecutive invalid logon attempts by a user during [Organization-defined: time period] is enforced;
AC-07b.automatically [Organization-defined: ac-07_odp.03] when the maximum number of unsuccessful attempts is exceeded.

Examine

Access control policy
procedures addressing unsuccessful logon attempts
system design documentation
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records

Interview

Organizational personnel with information security responsibilities
system developers
system/network administrators

Test

Mechanisms implementing access control policy for unsuccessful logon attempts

Official relationships

Related controls

These relationships come from the official OSCAL catalog. They indicate useful dependencies or context, not automatic inheritance or equivalence.

MITRE D3FEND semantic mapping

Related defensive techniques

D3FEND maps this base control or one of its enhancements to the following defensive techniques. The ontology relation label is preserved and does not by itself prove implementation or effectiveness.

AC-7 · D3-ALAccount LockingExact semantic relationship AC-7(3) · D3-ALAccount LockingControl is narrower AC-7(4) · D3-ALAccount LockingControl is broader

MITRE D3FEND™ and the D3FEND logo are trademarks of The MITRE Corporation. Bare Metal Cyber is not affiliated with or endorsed by MITRE.

Official NIST enhancements

Control enhancements

Enhancements add specificity, strength, or scope to the base control. Baseline badges show explicit selections in the official SP 800-53B OSCAL profiles.

Official NIST control enhancement

AC-7(1) — Automatic Account Lock

Withdrawn

This enhancement is marked withdrawn in the official OSCAL catalog. Related-control metadata below may identify where its intent was incorporated.

Official NIST control enhancement

AC-7(2) — Purge or Wipe Mobile Device

Purge or wipe information from [Organization-defined: mobile devices] based on [Organization-defined: purging or wiping requirements and techniques] after [Organization-defined: number] consecutive, unsuccessful device logon attempts.

Official discussion

A mobile device is a computing device that has a small form factor such that it can be carried by a single individual; is designed to operate without a physical connection; possesses local, non-removable or removable data storage; and includes a self-contained power source. Purging or wiping the device applies only to mobile devices for which the organization-defined number of unsuccessful logons occurs. The logon is to the mobile device, not to any one account on the device. Successful logons to accounts on mobile devices reset the unsuccessful logon count to zero. Purging or wiping may be unnecessary if the information on the device is protected with sufficiently strong encryption mechanisms.

Organization-defined parameters (3)

mobile devicesmobile devices to be purged or wiped of information are defined;

purging or wiping requirements and techniquespurging and wiping requirements and techniques to be used when mobile devices are purged or wiped of information are defined;

numberthe number of consecutive, unsuccessful logon attempts before the information is purged or wiped from mobile devices is defined;

Assessment objectives and methods

information is purged or wiped from [Organization-defined: mobile devices] based on [Organization-defined: purging or wiping requirements and techniques] after [Organization-defined: number] consecutive, unsuccessful device logon attempts.

Examine

Access control policy
procedures addressing unsuccessful logon attempts on mobile devices
system design documentation
system configuration settings and associated documentation
list of mobile devices to be purged/wiped after organization-defined consecutive, unsuccessful device logon attempts
list of purging/wiping requirements or techniques for mobile devices
system audit records
system security plan
other relevant documents or records

Interview

System/network administrators
organizational personnel with information security responsibilities

Test

Mechanisms implementing access control policy for unsuccessful device logon attempts

Related controls

Official NIST control enhancement

AC-7(3) — Biometric Attempt Limiting

Limit the number of unsuccessful biometric logon attempts to [Organization-defined: number].

Official discussion

Biometrics are probabilistic in nature. The ability to successfully authenticate can be impacted by many factors, including matching performance and presentation attack detection mechanisms. Organizations select the appropriate number of attempts for users based on organizationally-defined factors.

Organization-defined parameters (1)

numberthe number of unsuccessful biometric logon attempts is defined;

Assessment objectives and methods

unsuccessful biometric logon attempts are limited to [Organization-defined: number].

Examine

Access control policy
procedures addressing unsuccessful logon attempts on biometric devices
system design documentation
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records

Interview

System/network administrators
organizational personnel with information security responsibilities

Test

Mechanisms implementing access control policy for unsuccessful logon attempts

Related controls

Official NIST control enhancement

AC-7(4) — Use of Alternate Authentication Factor

(a)Allow the use of [Organization-defined: authentication factors] that are different from the primary authentication factors after the number of organization-defined consecutive invalid logon attempts have been exceeded; and
(b)Enforce a limit of [Organization-defined: number] consecutive invalid logon attempts through use of the alternative factors by a user during a [Organization-defined: time period].

Official discussion

The use of alternate authentication factors supports the objective of availability and allows a user who has inadvertently been locked out to use additional authentication factors to bypass the lockout.

Organization-defined parameters (3)

authentication factorsauthentication factors allowed to be used that are different from the primary authentication factors are defined;

numberthe number of consecutive, invalid logon attempts through the use of alternative factors for which to enforce a limit by a user is defined;

time periodtime period during which a user can attempt logons through alternative factors is defined;

Assessment objectives and methods

AC-07(04)(a)[Organization-defined: authentication factors] that are different from the primary authentication factors are allowed to be used after the number of organization-defined consecutive invalid logon attempts have been exceeded;
AC-07(04)(b)a limit of [Organization-defined: number] consecutive invalid logon attempts through the use of the alternative factors by the user during a [Organization-defined: time period] is enforced.

Examine

Access control policy
procedures addressing unsuccessful logon attempts for primary and alternate authentication factors
system design documentation
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records

Interview

System/network administrators
organizational personnel with information security responsibilities

Test

Mechanisms implementing access control policy for unsuccessful logon attempts

Related controls

Source record

Authoritative sources

Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by NIST. Official control requirements and interpretations remain with NIST and the responsible authorizing organization.