AC-7(3)

Requirement

Limit the number of unsuccessful biometric logon attempts to [Assignment: organization-defined number].

Discussion

Biometrics are probabilistic in nature. The ability to successfully authenticate can be impacted by many factors, including matching performance and presentation attack detection mechanisms. Organizations select the appropriate number of attempts for users based on organizationally-defined factors.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Access control policy; procedures addressing unsuccessful logon attempts on biometric devices; system design documentation; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: System/network administrators; organizational personnel with information security responsibilities].

Test

[SELECT FROM: Mechanisms implementing access control policy for unsuccessful logon attempts].

ID	Assessment Objectives
AC-07(03)	unsuccessful biometric logon attempts are limited to <AC-07(03)_ODP number>.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!