SFS 3 / SF 9

Back to SFS 3

Status: Question model review passed; solution and completed SF authoring pending.

This is a generated authoring draft. Human approval and operational assessment results have not been supplied.

Question

Are account lockout policies enforced for all user accounts accessing critical services after a defined number of consecutive failed login attempts throughout the review period?

Plain-language explanation

Model-reviewed question draft. Completed explanations and a canonical solution are pending. The proposed positive criterion is: lockout policies are correctly configured and operational

Assessment criterion and evidence

Actor: organization. Scope: all user accounts accessing critical services. Evidence period: throughout the review period. Required evidence: documented lockout policy specifying attempt threshold; system configuration settings showing implementation; authentication logs demonstrating enforced lockouts. Negative criterion: lockout policies are absent, misconfigured, or ineffective. Missing evidence: absence of configuration records or authentication logs demonstrating enforcement

View the JSON record (opens in a new tab).

Assessment result: unset.