# CMMC 2.0 IA.2.081Store and transmit only cryptographically-protected passwords.

- Source: https://support.icompaas.com/support/solutions/articles/62000229490-cmmc-2-0-ia-2-081store-and-transmit-only-cryptographically-protected-passwords-
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CMMC](https://support.icompaas.com/support/solutions/62000112530) › [2.0](https://support.icompaas.com/support/solutions/folders/62000168778)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Level 2**

  

**Description:**

Cryptographically-protected passwords use salted one-way cryptographic hashes of passwords. See \[NIST CRYPTO\]. 

  

**Priority:** High 

  

**Domain: IDENTIFICATION AND AUTHENTICATION (IA)** 

  

**Services Associated with AWS:** 

-   AWS Secrets Manager, AWS Key Management Service (KMS) 

  

**Services Associated with Azure:**

-   Azure Active Directory (Azure AD)
-   Azure Key Vault
-   Azure Information Protection
-   Azure Security Center
-   Azure Sentinel
-   Azure Multi-Factor Authentication
-   Azure Confidential Computing
-   Azure Virtual Machines
-   Azure SQL Database
-   Azure Storage

  

Objective Evidence: 

-   Administrative: documented policies, standards & procedures
-   Administrative: supporting documentation to demonstrate the "secure practices" used to build technology platform-specific secure baseline configurations
-   Technical: screenshot of configuration settings 

  

Possible Technology Considerations:

-   Identity & Access Management (IAM)
-   Secure Baseline Configurations (SBC) 

  

**What needs to be answered:**

Are passwords prevented from being stored in reversible encryption form in any company systems? Are passwords stored as one-way hashes constructed from passwords? Does the company follow the best practice of “salting” hashed passwords? Are passwords encrypted in storage and in transmission? 

**Checks for AWS**

-   Cryptographic Protection of Passwords  
    Description: This check ensures that organizations store and transmit passwords in a cryptographically protected manner. Cryptographically protected passwords use techniques such as salted one-way cryptographic hashes to enhance their security. Storing passwords as cryptographic hashes with unique salts makes it computationally difficult to reverse-engineer the original passwords, even if the stored hashes are compromised. Transmitting passwords over networks should also be protected using encryption protocols to prevent interception and unauthorized access. 

  

**Checks for Azure**

-   Prevent Storage of Passwords in Reversible Encryption Form  
    Description: This check ensures that passwords are not stored in reversible encryption form in any company systems. Storing passwords in reversible encryption form can pose a significant security risk, as it allows for the potential exposure of plaintext passwords if the encryption mechanism is compromised. It is recommended to use one-way cryptographic hashing algorithms to store passwords securely.
-   Enforce Strong Password Hashing with Salting  
    Description: This check verifies that strong password hashing techniques with salting are enforced for password storage in Azure systems. Salting involves adding a random and unique value (salt) to each password before hashing it. This adds an extra layer of security by making it computationally difficult to reverse-engineer the original passwords, even if the stored hashes are compromised.
-   Encrypt Passwords in Storage and Transmission  
    Description: This check ensures that passwords are encrypted both in storage and during transmission. Passwords should be protected using encryption mechanisms to prevent unauthorized access and interception. This includes encrypting passwords stored in databases or other storage systems and encrypting passwords transmitted over networks, such as during user authentication processes.

  

**More Details:** All passwords that are stored are done via encrypted storage methods.

## Related compliance guidance

- [NIST SP 800-171 and CMMC: a practical guide to protecting CUI in the cloud](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3): The CUI requirements CMMC Level 2 assesses, the SPRS score, POA&M rules and the phased DFARS rollout.
- [NIST SP 800-53 Rev. 5: a practical implementation guide for cloud teams](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5): The federal catalogue 800-171 is derived from — useful when a contract also cites a FedRAMP baseline.