What it means
Password aging and lockout policy coordinates credential lifetime, failed-attempt controls, recovery, service-account handling, and monitoring without creating predictable resets or denial-of-service risk.
Why it matters
Credential policy must balance resistance to guessing and reuse with operational realities; poorly designed expiration and lockout rules can create new failure modes.
Practical focus
- Define the account classes and authentication systems subject to password controls and the identities, roles, and resources it covers
- Implement risk-based lifetime, failed-attempt, recovery, and privileged-account requirements through least-privilege, reviewable policy
- Use lockout patterns, reset volume, stale credentials, and exception use to confirm that effective access matches intended access
- Plan for an attacker causing lockouts or a service credential expiring without coordination, including safe recovery and break-glass handling
Common mistakes
- Granting broad access because it is easier to administer
- Changing policy without testing the effective identity context
- Allowing exceptions to persist without an owner or expiration
- Treating an attacker causing lockouts or a service credential expiring without coordination as a user problem instead of a control failure
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: