# NIST 800-171 3.1.8 Limit unsuccessful logon attempts.

- Source: https://support.icompaas.com/support/solutions/articles/62000229231-nist-800-171-3-1-8-limit-unsuccessful-logon-attempts-
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [NIST](https://support.icompaas.com/support/solutions/62000112528) › [800-171](https://support.icompaas.com/support/solutions/folders/62000168440)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description:** 

This requirement applies regardless of whether the logon occurs via a local or network connection.  Due to the potential for denial of service, automatic lockouts initiated by systems are, in most cases, temporary and automatically release after a predetermined period established by the organization (i.e., a delay algorithm). If a delay algorithm is selected, organizations may employ different algorithms for different system components based on the capabilities of the respective components. Responses to unsuccessful login attempts may be implemented at the operating system and application levels.

  

**Priority:** Medium

  

**Category: Centralized Controls Management** 

  

**Services Associated with AWS:** 

-   AWS Identity and Access Management (IAM)
-   AWS WAF, AWS Shield
-   AWS CloudWatch, Amazon GuardDuty, AWS Identity and Access Management (IAM) 

  

**Objective Evidence:** 

-   Administrative: documented policies, standards & procedures 
-   Administrative: supporting documentation to demonstrate the "secure practices" used to build technology platform-specific secure baseline configurations 
-   Technical: screen shot of configuration settings  
    

  

**Possible Technology Considerations:** Secure Baseline Configurations (SBC)  

  

**What needs to be answered:** 

Are accounts locked after some number of unsuccessful login attempts? 

  

-   Ensure Unsuccessful Logon Attempts Are Limited  
    Description: This check verifies that the system is configured to limit unsuccessful logon attempts, reducing the risk of unauthorized access via brute force methods.
-   Validate Automatic Lockout Settings  
    Description: This check confirms that automatic lockouts are initiated after a set number of unsuccessful logon attempts and that they release after a predetermined period established by the organization.
-   Check Delay Algorithm Implementation  
    Description: This check ensures that delay algorithms are employed to prevent denial of service attacks through repeated unsuccessful logon attempts. It also verifies that different algorithms are used for different system components, based on their capabilities.
-   Confirm Logon Attempt Response at OS and Application Levels  
    Description: This check verifies that responses to unsuccessful logon attempts, such as alerts or lockouts, are implemented both at the operating system and application levels. 

**More details:** Account lockout after six invalid password attempts.

## Related compliance guidance

- [NIST SP 800-53 Rev. 5: a practical implementation guide for cloud teams](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5): How the 800-53 catalogue, baselines and the Risk Management Framework fit together, and which controls take the most work in the cloud.
- [NIST SP 800-171 and CMMC: a practical guide to protecting CUI in the cloud](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3): If the driver is a DoD or federal contract handling CUI, 800-171 (and CMMC) is the scope you actually need.