3.5.10

Discussion

Cryptographically-protected passwords use salted one-way cryptographic hashes of passwords. See [NIST CRYPTO].

NIST 800-171A Assessment Guidance

Examine

[SELECT FROM: Identification and authentication policy; password policy; procedures addressing authenticator management; security plan; system design documentation; system configuration settings and associated documentation; password configurations and associated documentation; other relevant documents or records].
Interview

[SELECT FROM: Personnel with authenticator management responsibilities; personnel with information security responsibilities; system or network administrators; system developers].
Test

[SELECT FROM: Mechanisms supporting or implementing password-based authenticator management capability].

ID	Assessment Objectives
3.5.10[a]	Passwords are cryptographically protected in storage.
3.5.10[b]	Passwords are cryptographically protected in transit.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!