NIST 800-171 Controls · Identification & Authentication

IA.2.083 — Prohibit password reuse for a specified number of generations

CMMC Level 2SPRS if unmet: -1LOW priority~1h to implement

Prohibit password reuse for a specified number of generations.

What IA.2.083 means in plain English

Your employees cannot keep cycling back to the same password. If Windows remembers the last 24 passwords and refuses to let you re-use any of them, that is this control. This prevents the common habit of "Password1!" → "Password2!" → back to "Password1!" when forced to change. For your team, this is a single Group Policy setting that takes 2 minutes to configure and requires zero ongoing effort once set.

The assessment question

“Is password reuse technically prevented for a defined number of generations (minimum 5, ideally 24) on all systems — enforced at the system level, not just by policy?”

How to implement IA.2.083

In Group Policy Editor, navigate to Computer Configuration > Windows Settings > Security Settings > Account Policies > Password Policy and set "Enforce password history" to 24.
For Microsoft 365 accounts, the platform enforces password history automatically — verify this is not overridden to a lower value.
For any line-of-business applications with their own authentication (ERP, CRM), check if they have a password history setting and configure it to match.
Document the selected number of generations (24) in your Password Management Policy.
Test the enforcement by attempting to set a previous password on a test account and confirming the system rejects it.

Evidence your assessor will ask for

Group Policy screenshot showing "Enforce password history" set to 24 or greater
Microsoft 365 password settings screenshot
Password Management Policy document specifying the number of prohibited generations
Test evidence showing rejected attempt to reuse a previous password

Does AI prompt monitoring help with this control? Honestly, no.

IA.2.083 is met through the remediation steps above, not through AI traffic controls — an AI prompt firewall neither satisfies nor substitutes for it. We map AI monitoring only to the controls it genuinely evidences (flow control, boundary protection, audit, and incident support); for the full picture of where it does help, see the mapping guide linked below.

Full mapping: which 800-171 controls AI prompt monitoring evidences →

More Identification & Authentication controls

IA.1.076

Identify system users, processes, and devices

IA.1.077

Authenticate identities of users, processes, and devices

IA.2.078

Use multifactor authentication for local and network access

IA.2.079

Employ replay-resistant authentication mechanisms

IA.2.080

Prevent reuse of identifiers

IA.2.081

Disable identifiers after defined period of inactivity

Score yourself against all 110 controls

The free ShieldReady assessment walks every NIST 800-171 requirement, computes your SPRS score, and shows exactly which gaps cost the most points.

Start the free assessment $499 AI risk assessment