id: "AC-07(04)" title: "Use of Alternate Authentication Factor" family: "AC" family_name: "Access Control" sort_id: "ac-07.04" priority: "P1" implementation_level: "system" parent: "AC-07" enhancement: True
Allow the use of {{ insert: param, ac-07.04_odp.01 }} that are different from the primary authentication factors after the number of organization-defined consecutive invalid logon attempts have been exceeded; and
Enforce a limit of {{ insert: param, ac-07.04_odp.02 }} consecutive invalid logon attempts through use of the alternative factors by a user during a {{ insert: param, ac-07.04_odp.03 }}.
Guidance
The use of alternate authentication factors supports the objective of availability and allows a user who has inadvertently been locked out to use additional authentication factors to bypass the lockout.
Assessment Objective: {{ insert: param, ac-07.04_odp.01 }} that are different from the primary authentication factors are allowed to be used after the number of organization-defined consecutive invalid logon attempts have been exceeded;
Assessment Objective: a limit of {{ insert: param, ac-07.04_odp.02 }} consecutive invalid logon attempts through the use of the alternative factors by the user during a {{ insert: param, ac-07.04_odp.03 }} is enforced.
Access control policy
procedures addressing unsuccessful logon attempts for primary and alternate authentication factors
system design documentation
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records
System/network administrators
organizational personnel with information security responsibilities
Mechanisms implementing access control policy for unsuccessful logon attempts