AC.2.008 — Limit Unsuccessful Logon Attempts

CMMC Level 2SPRS if unmet: -3HIGH priority~3h to implement

Limit unsuccessful logon attempts.

What AC.2.008 means in plain English

If someone (or a hacking program) keeps guessing the wrong password to get into one of your systems, the system should automatically lock that account after a certain number of failed tries — typically 3 to 10 attempts. This stops automated programs from trying thousands of passwords until they get lucky.

The assessment question

“Are your systems configured to lock a user account automatically after a defined number of consecutive failed login attempts (typically between 3 and 10), and do you have this setting documented and applied consistently across all systems?”

How to implement AC.2.008

Set Windows account lockout policy: open Local Security Policy (secpol.msc) > Account Policies > Account Lockout Policy. Set "Account lockout threshold" to 5 invalid attempts, "Account lockout duration" to 15 minutes, and "Reset account lockout counter after" to 15 minutes.
For Microsoft 365 accounts, enable Smart Lockout in Microsoft Entra ID: Azure Portal > Microsoft Entra ID > Security > Authentication methods > Password protection. Set lockout threshold to 10 and lockout duration to 60 seconds minimum.
For any web-based systems or VPN portals, verify that the vendor's lockout settings are enabled — check vendor documentation or admin console settings.
Test the lockout works: on a test account, deliberately enter the wrong password the defined number of times and confirm the account locks. Document the test as evidence.
Ensure admins receive an alert when accounts are locked out frequently (a sign of a brute-force attack) — Microsoft 365 can be configured to alert on this via the Microsoft Defender portal.

Evidence your assessor will ask for

Screenshot of Windows Account Lockout Policy settings (secpol.msc)
Screenshot of Microsoft Entra ID Smart Lockout configuration
Written policy documenting defined lockout threshold and duration
Test evidence showing lockout activates after defined failed attempts
VPN or remote access portal lockout settings screenshot (if applicable)

Does AI prompt monitoring help with this control? Honestly, no.

AC.2.008 is met through the remediation steps above, not through AI traffic controls — an AI prompt firewall neither satisfies nor substitutes for it. We map AI monitoring only to the controls it genuinely evidences (flow control, boundary protection, audit, and incident support); for the full picture of where it does help, see the mapping guide linked below.

Full mapping: which 800-171 controls AI prompt monitoring evidences →

More Access Control controls

AC.1.001

Limit System Access to Authorized Users

AC.1.002

Limit System Access to Authorized Transaction Types

AC.2.003

Control CUI Flow per Authorizations

AC.2.004

Separate Duties to Reduce Risk

AC.2.005

Employ Least Privilege

AC.2.006

Use Non-Privileged Accounts for Non-Security Functions

Score yourself against all 110 controls

The free ShieldReady assessment walks every NIST 800-171 requirement, computes your SPRS score, and shows exactly which gaps cost the most points.

Start the free assessment $499 AI risk assessment