3.5.8[a]

Determination Statement

The number of generations during which a password cannot be reused is specified.

Requirement Discussion

Password lifetime restrictions do not apply to temporary passwords

NIST 800-171A Assessment Guidance

Examine

[SELECT FROM: Identification and authentication policy; password policy; procedures addressing authenticator management; security plan; system design documentation; system configuration settings and associated documentation; password configurations and associated documentation; other relevant documents or records].
Interview

[SELECT FROM: Personnel with authenticator management responsibilities; personnel with information security responsibilities; system or network administrators; system developers].
Test

[SELECT FROM: Mechanisms supporting or implementing password-based authenticator management capability].

ID	Related Determination Statements
3.5.8[b]	Reuse of passwords is prohibited during the specified number of generations.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!