Quality, Expert-Derived Cybersecurity Documentation To Keep Organizations Secure, Compliant & Resilient  |  Got Questions? +1-307-241-8740
ComplianceForge
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
CartAccount
Start Here ▾
Products ▾
Bundles ▾
Updates ▾
Reasons To Buy ▾
Certification Options ▾

How Do I Implement NIST 800-171 R3 03.01.08 Unsuccessful Logon Attempts?

NIST 800-171 R3 03.01.08 Unsuccessful Logon Attempts at a Glance

  • Family: 03.01 Access Control (AC)
  • Requirement ID: 03.01.08 Unsuccessful Logon Attempts
  • Assessment Objectives (AOs): Six (6) total, including the four (4) Organization-Defined Parameters (ODPs) below and two (2) determination statements
  • Organization-Defined Parameters (ODPs): Three (3), specified by the Department of Defense (DoD) for the Defense Industrial Base (DIB)
  • Source NIST 800-53 R5 Control: AC-07
  • NIST 800-171 R3 Kill Chain Phase: Phase 12, Secure Baseline Configurations (SBC)

Unsuccessful Logon Attempts is a bounded, configurable control that limits how many times someone can guess their way into an account before the system reacts. Where Account Management (03.01.01) and Access Enforcement (03.01.02) decide who gets in and how authorizations are applied, Unsuccessful Logon Attempts (03.01.08) decides what happens when someone repeatedly fails to get in. It has two (2) parts: enforce a limit on consecutive invalid logon attempts within a defined window, and take a defined automatic action when that limit is exceeded. This is the requirement behind the familiar account lockout, but R3 makes both the threshold and the response into parameters you have to set, and for Department of Defense (DoD) contractors those parameters are already specified.

A common difficulty with this requirement is assuming a default lockout policy satisfies it. It might, but only if your defined number, time period, and lockout action match what your contract requires. R3 wraps four (4) Organization-Defined Parameters (ODPs) around this control, including a selection of which automatic action to take. If you have never written down your threshold and your response, or if your configured values are weaker than the DoD-specified ones, you cannot demonstrate the requirement.

Where things stand for companies facing the transition from NIST 800-171 R2 to R3:

  • The National Institute of Standards and Technology (NIST) withdrew R2 on May 14, 2024, the same day R3 was published. The withdrawal notice states that R2 "has been withdrawn (archived), and is provided solely for historical purposes," so it will never receive another correction or clarification from NIST.
  • R2 remains the contractual standard for the Department of Defense (DoD) and the Defense Industrial Base (DIB). Cybersecurity Maturity Model Certification (CMMC) assessments reference it directly: per Title 32 of the Code of Federal Regulations (CFR), section 170.14(c)(3), "the security requirements in CMMC Level 2 are identical to the requirements in NIST SP 800-171 R2."
  • The rulemaking points the other direction. The proposed Controlled Unclassified Information (CUI) rule for the Federal Acquisition Regulation (FAR), published June 23, 2026 as part of the Revolutionary FAR Overhaul, would apply CUI safeguarding requirements government wide rather than only to DoD contracts, and it sets the baseline at R3. That rule is not final, and DoD has separately signaled an interim rule to move CMMC to R3.

What Does NIST 800-171 R3 03.01.08 Actually Require?

The following is reproduced verbatim from NIST 800-171 R3, requirement 03.01.08 Unsuccessful Logon Attempts. Only the formatting has been adjusted for readability. This requirement has two (2) lettered parts:

  • a. Enforce a limit of [Assignment: organization-defined number] consecutive invalid logon attempts by a user during a [Assignment: organization-defined time period].
  • b. Automatically [Selection (one or more): lock the account or node for an [Assignment: organization-defined time period]; lock the account or node until released by an administrator; delay next logon prompt; notify system administrator; take other action] when the maximum number of unsuccessful attempts is exceeded.

The source control is AC-07 from NIST 800-53. Note that part b is a Selection, not just an Assignment: you pick one or more of the listed automatic actions. Per the NIST discussion, automatic lockouts are in most cases temporary and release after a predetermined time period to avoid a denial-of-service condition, and responses can be implemented at the system and application levels. You can read the requirement directly at NIST 800-171 R3, 03.01.08 (p. 12).

What Are the Organization-Defined Parameters (ODPs) Associated with NIST 800-171 R3 03.01.08?

Three (3) values sit inside this requirement. Depending on your contract, your organization may be permitted to define them. Organizations in the DIB subject to CMMC are not, because the DoD has defined them as policy.

The values below come from Attachment A of the DoD Chief Information Officer (CIO) memorandum dated 10 April 2025 (signed David W. McKeown). The memo identifies each parameter by requirement sub-part, while NIST 800-171A R3 identifies the same parameter by ODP number. Both identifiers appear below so you can match your System Security Plan (SSP) language to either document.

  • ODP[01] (DoD memo identifier 03.01.08.a.01). the number of consecutive invalid logon attempts by a user allowed during a time period is defined. DoD Position: at most five (5).
  • ODP[02] (DoD memo identifier 03.01.08.a.02). the time period to which the number of consecutive invalid logon attempts by a user is limited is defined. DoD Position: period of five (5) minutes.
  • ODP[03] (DoD memo identifier 03.01.08.b). one or more of the following PARAMETER VALUES are selected: {the account or node is locked automatically for <A.03.01.08.ODP[04]: time period>; the account or node is locked automatically until released by an administrator; the next logon prompt is delayed automatically; the system administrator is notified automatically; other action is taken automatically}. DoD Position: [Selection (one or more): lock the account or node for an at least 15-minute time period; lock the account or node until released by an administrator and notify a system administrator].
  • ODP[04] (DoD memo identifier 03.01.08.b). the time period for an account or node to be locked is defined (if selected). DoD Position: [Selection (one or more): lock the account or node for an at least 15-minute time period; lock the account or node until released by an administrator and notify a system administrator].

Note the asymmetry: NIST 800-171A R3 decomposes this requirement into four (4) Organization-Defined Parameters, while the DoD memorandum addresses them with three (3) entries, because a single bracketed assignment in the requirement text covers more than one parameter under assessment. Each ODP still needs its own answer in the System Security Plan (SSP).

The memo states that its values "will be updated as necessary," so confirm against the current version before writing them into policy.

What Are the Assessment Objectives (AOs) For NIST 800-171 R3 03.01.08?

NIST 800-171A R3 breaks 03.01.08 into six (6) assessment objectives: four (4) Organization-Defined Parameters (ODPs) and two (2) determination statements. These AOs are:

  • A.03.01.08.ODP[01]: the number of consecutive invalid logon attempts by a user allowed during a time period is defined.
  • A.03.01.08.ODP[02]: the time period to which the number of consecutive invalid logon attempts by a user is limited is defined.
  • A.03.01.08.ODP[03]: one or more of the following PARAMETER VALUES are selected: {the account or node is locked automatically for <A.03.01.08.ODP[04]: time period>; the account or node is locked automatically until released by an administrator; the next logon prompt is delayed automatically; the system administrator is notified automatically; other action is taken automatically}.
  • A.03.01.08.ODP[04]: the time period for an account or node to be locked is defined (if selected).
  • A.03.01.08.a: a limit of <A.03.01.08.ODP[01]: number> consecutive invalid logon attempts by a user during <A.03.01.08.ODP[02]: time period> is enforced.
  • A.03.01.08.b: <A.03.01.08.ODP[03]: SELECTED PARAMETER VALUES> when the maximum number of unsuccessful attempts is exceeded.

The four (4) ODPs are where the work is. If you are a DoD contractor, they are not open questions. Per the DoD-specified ODP values in ComplianceForge's NIST 800-171 R3 Transition Guide, the number of consecutive invalid attempts (ODP[01]) is set to at most five (5), the time period (ODP[02]) is a period of five (5) minutes, and the automatic action (ODP[03]) is to lock the account or node for at least a fifteen (15) minute period, or lock the account or node until released by an administrator and notify a system administrator. The full guidance on assessment methods and objects, is in NIST 800-171A R3, 03.01.08 (p. 14).

Assessment Methods and Objects for NIST 800-171 R3 03.01.08

Examine: access control policy and procedures; procedures for unsuccessful logon attempts; system design documentation; system audit records; system configuration settings; system security plan.

Interview: personnel with information security responsibilities; system developers; system administrators.

Test: mechanisms for implementing the access control policy for unsuccessful logon attempts.

How Does NIST 800-171 R3 03.01.08 Map From NIST 800-171 R2?

03.01.08 maps from NIST 800-171 R2 requirement 3.1.8 (limit unsuccessful logon attempts):

  • A.03.01.08.ODP[01] maps directly to R2 3.1.8[a] (the means of limiting unsuccessful logon attempts is defined).
  • A.03.01.08.ODP[02], A.03.01.08.ODP[03], A.03.01.08.ODP[04], A.03.01.08.a, and A.03.01.08.b map indirectly to elements of R2 3.1.8[b] (the defined means of limiting unsuccessful logon attempts is enforced).

Mapped against the six (6) AOs, one (1) is direct (minimal effort) and five (5) are indirect (moderate effort), with no net-new AOs and none with no mapping. The concept did not change, but R3 unbundled it. R2 had a single "means" of limiting attempts and enforcing it. R3 breaks that means into an explicit number, an explicit time window, an explicit selection of automatic actions, and a lockout duration, then assesses enforcement of both the limit and the action separately. Your existing lockout may already do this, but you have to re-express it as the four R3 parameters and confirm the values match your contract.

How Does NIST 800-171 R3 03.01.08 Map to NIST 800-53 R5 and the SCF?

Source Control in NIST 800-53 R5:

  • AC-07

Secure Controls Framework (SCF) Crosswalk

Organizations running a single control set across multiple frameworks can satisfy 03.01.08 through the following SCF controls:

  • CFG-04 Secure Baseline Configurations
  • CFG-04.1 Account Lockout

The crosswalks from NIST 800-171 R3 and NIST 800-171A R3 to the SCF are available at no cost through the SCF Set Theory Relationship Mapping (STRM): https://securecontrolsframework.com/start-here/set-theory-relationship-mapping-strm. The STRM also carries the relationship type for each mapping (Equal, Subset Of, Intersects With), which tells you whether an SCF control fully satisfies the requirement or only part of it. Mapping above taken from SCF 2026.3.

Common Pitfalls with NIST 800-171 R3 03.01.08

The following are issues teams may encounter rather than certainties. They are about the parameters and the selection, each of which needs documented evidence of due diligence and due care such as policies, standards, procedures, and configuration screenshots:

  • The parameters are not yours to guess for DoD work. The DoD-specified values (at most five attempts, a five-minute window, and a lockout of at least fifteen minutes or until an administrator releases it plus notification) are the floor. A default of ten attempts will not pass a DoD assessment.
  • Part b is a selection, and you must actually implement what you selected. A.03.01.08.b checks that your selected parameter values happen when the limit is exceeded. Documenting that you will lock accounts but not configuring it is a finding.
  • Lockout duration only matters if you selected the lock-for-a-time-period option. ODP[04] is conditional (if selected). If you chose lock-until-administrator-release instead, you do not need a duration, but you do need the administrator process.
  • Enforcement can live at more than one layer. Per the NIST discussion, responses to unsuccessful logon attempts may be implemented at both the system and application levels. Applications that authenticate separately from the operating system need their own enforcement.

What Is Reasonable Evidence For NIST 800-171 R3 03.01.08?

Reasonable objective evidence for an assessment is often subjective. The following examples of evidence to address NIST 800-171 R3 03.01.08 are sourced from the SCF Evidence Request List (ERL), available at https://securecontrolsframework.com/free-content/scf-download. These ERL artifacts are mapped to NIST 800-171 R3 03.01.08 through SCF controls. They establish a starting point for discussions on what an organization needs to have for evidence of due diligence and due care to withstand external scrutiny by an assessor or regulator.

  • E-AST-12 Secure Baseline Configurations Reviews. A review process to ensure secure baseline configurations (sbc) are current and applicable (e.g., system configuration settings and associated documentation).
  • E-AST-13 Secure Baseline Configurations - Cloud-Based Services. Secure baseline configurations for all deployed types of cloud-based services or applications.
  • E-AST-14 Secure Baseline Configurations - Databases. Secure baseline configurations for all deployed types of databases.
  • E-AST-15 Secure Baseline Configurations - Embedded Technologies. Secure baseline configurations for all deployed types of embedded technologies.
  • E-AST-16 Secure Baseline Configurations - Major Applications. Secure baseline configurations for all deployed types of major applications.
  • E-AST-17 Secure Baseline Configurations - Minor Applications. Secure baseline configurations for all deployed types of minor applications.
  • E-AST-18 Secure Baseline Configurations - Mobile Devices. Secure baseline configurations for all deployed types of mobile devices.
  • E-AST-19 Secure Baseline Configurations - Network Devices. Secure baseline configurations for all deployed types of network devices.
  • E-AST-20 Secure Baseline Configurations - Server Class Systems. Secure baseline configurations for all deployed types of server-class operating systems.
  • E-AST-21 Secure Baseline Configurations - Workstation Class Systems. Secure baseline configurations for all deployed types of workstation-class operating systems.
  • E-IAC-17 Authenticator Configuration Settings. Authenticator management settings (e.g., password complexity, default authenticator changes, account lockout, protection of authenticators).

Alongside these, keep the System Security Plan (SSP) narrative for 03.01.08 recording the ODP values you adopted.

Timeline Considerations for NIST 800-171 R3 03.01.08

With one AO mapping directly and five indirectly, 03.01.08 is a moderate lift, but a fast one if you already lock accounts. A realistic sequence:

  1. Set the four (4) ODPs. For DoD contracts, adopt the DoD-specified values: at most five (5) consecutive invalid attempts, a five (5) minute window, and lockout for at least fifteen (15) minutes or until an administrator releases the account with notification. For non-DoD scopes, define and document your own.
  2. Configure the limit (A.03.01.08.a) at the system and, where applicable, application levels.
  3. Configure the selected automatic action (A.03.01.08.b) so it actually triggers when the limit is exceeded.
  4. Collect evidence for all six (6) AOs, including the parameter definitions and configuration screen shots showing the limit and the action.

Frequently Asked Questions About NIST 800-171 R3 03.01.08

What value does the DoD require for the first parameter in NIST 800-171 R3 03.01.08? R3 leaves the value to the organization. For the DIB, the DoD set it in the 10 April 2025 memorandum under ODP identifier 03.01.08.a.01: at most five (5).

How many assessment objectives does NIST 800-171 R3 03.01.08 have? NIST 800-171A R3 breaks 03.01.08 into six (6) assessment objectives: four (4) Organization-Defined Parameters (ODPs) and two (2) determination statements. An assessor works through each one separately, so each needs its own evidence.

Which NIST 800-53 R5 control does NIST 800-171 R3 03.01.08 come from? AC-07.

Where does NIST 800-171 R3 03.01.08 sit in the NIST 800-171 R3 Kill Chain? Phase 12, Secure Baseline Configurations (SBC). The Kill Chain is a phased model for sequencing R3 implementation, and it assigns this requirement to that phase.

Bottom Line on NIST 800-171 R3 03.01.08

03.01.08 Unsuccessful Logon Attempts limits consecutive invalid logon attempts and triggers a defined automatic response when the limit is exceeded. It maps from R2 3.1.8 with one assessment objective transitioning directly and five indirectly, so there is no net-new objective, but R3 unbundles the old single "means" into four parameters you must define and enforce. The recurring problem is assuming a stock lockout policy is enough. Set the number, the window, the action, and the lockout duration to the values your contract requires, then prove both the limit and the response are enforced.

Authoritative sources:

Authoritative sources:

This guide reproduces U.S. Government text from NIST 800-171 R3 and NIST 800-171A R3 and references the DoD ODP memorandum of 10 April 2025. It is educational, not legal or assessment advice. Last reviewed: 2026-09-22.