NIST 800-53 AC-7 Unsuccessful Logon Attempts and Lockouts

AC-7 asks for two things. Enforce a limit on consecutive invalid logon attempts within a time window you set, and take a defined action when the limit is passed.

800-53 binds federal systems and, by contract, some suppliers. Other teams meet it constantly through questionnaires about brute force protection.

What it means in practice

The guidance says the limit applies to local and network logons alike. It warns about denial of service: because an attacker can lock out real users on purpose, most automatic lockouts are temporary and release after a set time.

It lists actions beyond a plain lockout. These include extra challenge questions, a limited capability mode, restricting logon to certain IP addresses, a CAPTCHA, and profile checks on location, time, device or address.

Enhancements: AC-7.1 Automatic Account Lock, AC-7.2 Purge or Wipe Mobile Device, AC-7.3 Biometric Attempt Limiting, AC-7.4 Use of Alternate Authentication Factor.

Evidence to collect

• Policy values: attempts allowed, the window, the response, the release time.
• Identity provider or application settings that enforce them.
• A test log showing the lock after the threshold.
• Alerts or tickets from real lockout events.

Common gaps

• Lockouts on the web app but not on the API or SSH.
• Service accounts exempt with no other protection.
• Lockout counters that reset when the attacker changes IP.

How to implement it

Pick a modest limit, say five to ten attempts, with a temporary lock. Use rate limiting for APIs. Pair it with multi factor authentication, and log every lock so someone sees a spray pattern.

Quick check

Sources

• NIST SP 800-53 Rev 5, AC-7: https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_1_1/home?element=AC-7
• NIST OSCAL catalog of SP 800-53 Rev 5: https://raw.githubusercontent.com/usnistgov/oscal-content/main/nist.gov/SP800-53/rev5/json/NIST_SP-800-53_rev5_catalog.json