NIST 800-171 R3 03.05.07 Password Management at a Glance
- Family: 03.05 Identification and Authentication (IA)
- Requirement ID: 03.05.07 Password Management
- Assessment Objectives (AOs): Ten (10) total, including the two (2) Organization-Defined Parameters (ODPs) below and eight (8) determination statements
- Organization-Defined Parameters (ODPs): Two (2), specified by the Department of Defense (DoD) for the Defense Industrial Base (DIB)
- Source NIST 800-53 R5 Control: IA-05(01)
- NIST 800-171 R3 Kill Chain Phase: Phase 12, Secure Baseline Configurations (SBC) for parts c, d, e, f; Phase 13, Identity & Access Management (IAM) for parts a, b
Password Management is where R3 modernizes how passwords are handled, moving in line with current federal identity guidance. It sits within the Identification and Authentication (03.05) family and complements Multi-Factor Authentication (03.05.03) by governing the password factor itself. Password Management (03.05.07) has six (6) parts: maintain and update a list of commonly used, expected, or compromised passwords, verify that new or changed passwords are not on that list, transmit passwords only over cryptographically protected channels, store passwords in a cryptographically protected form, require a new password after account recovery, and enforce defined composition and complexity rules. Per the NIST discussion, long passwords and passphrases are preferable, enforced composition rules provide marginal benefit while reducing usability, and cryptographically protected passwords include salted one-way hashes.
A common difficulty with this requirement is carrying over old habits like forced periodic rotation and complex character rules while missing the new requirement to screen passwords against a breach and common-password list. That breach-list screening is the modern control, and it is new for R3. For Department of Defense (DoD) contractors, the composition rules and the list-update frequency are specified.
Where things stand for companies facing the transition from NIST 800-171 R2 to R3:
- The National Institute of Standards and Technology (NIST) withdrew R2 on May 14, 2024, the same day R3 was published. The withdrawal notice states that R2 "has been withdrawn (archived), and is provided solely for historical purposes," so it will never receive another correction or clarification from NIST.
- R2 remains the contractual standard for the Department of Defense (DoD) and the Defense Industrial Base (DIB). Cybersecurity Maturity Model Certification (CMMC) assessments reference it directly: per Title 32 of the Code of Federal Regulations (CFR), section 170.14(c)(3), "the security requirements in CMMC Level 2 are identical to the requirements in NIST SP 800-171 R2."
- The rulemaking points the other direction. The proposed Controlled Unclassified Information (CUI) rule for the Federal Acquisition Regulation (FAR), published June 23, 2026 as part of the Revolutionary FAR Overhaul, would apply CUI safeguarding requirements government wide rather than only to DoD contracts, and it sets the baseline at R3. That rule is not final, and DoD has separately signaled an interim rule to move CMMC to R3.
What Does NIST 800-171 R3 03.05.07 Actually Require?
The following is reproduced verbatim from NIST 800-171 R3, requirement 03.05.07 Password Management. Only the formatting has been adjusted for readability. This requirement has six (6) lettered parts:
- a. Maintain a list of commonly-used, expected, or compromised passwords, and update the list [Assignment: organization-defined frequency] and when organizational passwords are suspected to have been compromised.
- b. Verify that passwords are not found on the list of commonly used, expected, or compromised passwords when users create or update passwords.
- c. Transmit passwords only over cryptographically protected channels.
- d. Store passwords in a cryptographically protected form.
- e. Select a new password upon first use after account recovery.
- f. Enforce the following composition and complexity rules for passwords: [Assignment: organization-defined composition and complexity rules].
The source control is IA-05(01) from NIST 800-53. The bracketed assignments in parts a and f are the Organization-Defined Parameters (ODPs): the list-update frequency and the composition and complexity rules. Per the NIST discussion, the list of common or compromised passwords includes passwords from previous breach corpuses, dictionary words, repetitive or sequential characters, and context-specific words such as the service name and username. You can read the requirement directly at NIST 800-171 R3, 03.05.07 (p. 36).
What Are the Organization-Defined Parameters (ODPs) Associated with NIST 800-171 R3 03.05.07?
Two (2) values sit inside this requirement. Depending on your contract, your organization may be permitted to define them. Organizations in the DIB subject to CMMC are not, because the DoD has defined them as policy.
The values below come from Attachment A of the DoD Chief Information Officer (CIO) memorandum dated 10 April 2025 (signed David W. McKeown). The memo identifies each parameter by requirement sub-part, while NIST 800-171A R3 identifies the same parameter by ODP number. Both identifiers appear below so you can match your System Security Plan (SSP) language to either document.
- ODP[01] (DoD memo identifier 03.05.07.a). the frequency at which to update the list of commonly used, expected, or compromised passwords is defined. DoD Position: at least quarterly.
- ODP[02] (DoD memo identifier 03.05.07.f). password composition and complexity rules are defined. DoD Position: 1) Must have a minimum length of 16 characters. 2) Contains a string of characters that does not include the user’s account name or full name.
The memo states that its values "will be updated as necessary," so confirm against the current version before writing them into policy.
What Are the Assessment Objectives (AOs) For NIST 800-171 R3 03.05.07?
NIST 800-171A R3 breaks 03.05.07 into ten (10) assessment objectives: two (2) Organization-Defined Parameters (ODPs) and eight (8) determination statements. These AOs are:
- A.03.05.07.ODP[01]: the frequency at which to update the list of commonly used, expected, or compromised passwords is defined.
- A.03.05.07.ODP[02]: password composition and complexity rules are defined.
- A.03.05.07.a[01]: a list of commonly used, expected, or compromised passwords is maintained.
- A.03.05.07.a[02]: a list of commonly used, expected, or compromised passwords is updated <A.03.05.07.ODP[01]: frequency>.
- A.03.05.07.a[03]: a list of commonly used, expected, or compromised passwords is updated when organizational passwords are suspected to have been compromised.
- A.03.05.07.b: passwords are verified not to be found on the list of commonly used, expected, or compromised passwords when they are created or updated by users.
- A.03.05.07.c: passwords are only transmitted over cryptographically protected channels.
- A.03.05.07.d: passwords are stored in a cryptographically protected form.
- A.03.05.07.e: a new password is selected upon first use after account recovery.
- A.03.05.07.f: the following composition and complexity rules for passwords are enforced: <A.03.05.07.ODP[02]: rules>.
If you are a DoD contractor, the ODPs are specified. Per the DoD-specified ODP values in ComplianceForge's NIST 800-171 R3 Transition Guide, the list-update frequency (ODP[01]) is at least quarterly, and the composition and complexity rules (ODP[02]) require a minimum length of sixteen (16) characters and a string of characters that does not include the user's account name or full name. The full guidance on assessment methods and objects, is in NIST 800-171A R3, 03.05.07 (p. 46).
Assessment Methods and Objects for NIST 800-171 R3 03.05.07
Examine: identification and authentication policy and procedures; password policy; procedures for authenticator management; system design documentation; system configuration settings; password configurations; system security plan.
Interview: personnel with authenticator management responsibilities; personnel with information security responsibilities; system developers; system administrators.
Test: mechanisms for supporting or implementing a password-based authenticator management capability.
How Does NIST 800-171 R3 03.05.07 Map From NIST 800-171 R2?
03.05.07 maps from NIST 800-171 R2 requirement 3.5.7 (enforce a minimum password complexity and change of characters when new passwords are created), and it draws on R2 requirements 3.5.9 (allow temporary password use for system logons with an immediate change to a permanent password) and 3.5.10 (store and transmit only cryptographically protected passwords):
- A.03.05.07.ODP[01] and A.03.05.07.ODP[02] map directly to R2 3.5.7[b] and 3.5.7[a] (the complexity and change requirements are defined).
- A.03.05.07.c and A.03.05.07.d map directly to R2 3.5.10[b] and 3.5.10[a] (cryptographic protection in transit and storage).
- A.03.05.07.e maps indirectly to elements of R2 3.5.9, and A.03.05.07.f maps indirectly to elements of R2 3.5.7[c] and 3.5.7[d].
- A.03.05.07.a[03] and A.03.05.07.b are net new for R3.
- A.03.05.07.a[01] and A.03.05.07.a[02] have no clear mapping to any R2 assessment objective.
Mapped against the ten (10) AOs, four (4) are direct (minimal effort), two (2) are indirect (moderate effort), two (2) are net new, and two (2) have no clear mapping, with the last two (2) categories both counting as significant effort. Cryptographic storage and transmission carry forward, but the breach and common-password list, which spans maintaining, updating, and screening against it, is new work. Four of the ten (10) objectives are significant effort.
How Does NIST 800-171 R3 03.05.07 Map to NIST 800-53 R5 and the SCF?
Source Control in NIST 800-53 R5:
Secure Controls Framework (SCF) Crosswalk
Organizations running a single control set across multiple frameworks can satisfy 03.05.07 through the following SCF controls:
- CFG-04 Secure Baseline Configurations
- IAC-03 Authenticate, Authorize and Audit (AAA)
- IAC-08 Account Management
- IAC-08.1 Automated System Account Management (Directory Services)
- IAC-14 Authenticator Management
- IAC-14.2 Protection of Authenticators
- IAC-14.3 No Embedded Unencrypted Static Authenticators
- IAC-14.4 Default Authenticators
- IAC-15 Password-Based Authentication
- IAC-15.1 Automated Support For Password Strength
- IAC-15.2 Password Managers
The crosswalks from NIST 800-171 R3 and NIST 800-171A R3 to the SCF are available at no cost through the SCF Set Theory Relationship Mapping (STRM): https://securecontrolsframework.com/start-here/set-theory-relationship-mapping-strm. The STRM also carries the relationship type for each mapping (Equal, Subset Of, Intersects With), which tells you whether an SCF control fully satisfies the requirement or only part of it. Mapping above taken from SCF 2026.3.
Common Pitfalls with NIST 800-171 R3 03.05.07
The following are issues teams may encounter rather than certainties. They are about the breach-list screening and modern password rules, each of which needs documented evidence of due diligence and due care such as policies, standards, procedures, and configuration screenshots:
- The breach and common-password list is net new. A.03.05.07.a[01] through a[03] and b require maintaining, updating, and screening against a list of commonly used, expected, or compromised passwords. Traditional complexity rules do not satisfy these objectives.
- Modern guidance changes old habits. Per the NIST discussion, long passphrases beat short complex passwords, and forced composition rules give marginal benefit. For DoD work the rule is a sixteen-character minimum, not a symbol-and-rotation policy.
- Protect in transit and at rest. A.03.05.07.c and d require cryptographically protected channels and storage, such as salted one-way hashes. Plaintext or reversible storage fails these objectives.
- New password after account recovery. A.03.05.07.e requires selecting a new password on first use after recovery, so temporary recovery passwords must be changed immediately.
What Is Reasonable Evidence For NIST 800-171 R3 03.05.07?
Reasonable objective evidence for an assessment is often subjective. The following examples of evidence to address NIST 800-171 R3 03.05.07 are sourced from the SCF Evidence Request List (ERL), available at https://securecontrolsframework.com/free-content/scf-download. These ERL artifacts are mapped to NIST 800-171 R3 03.05.07 through SCF controls. They establish a starting point for discussions on what an organization needs to have for evidence of due diligence and due care to withstand external scrutiny by an assessor or regulator.
- E-AST-12 Secure Baseline Configurations Reviews. A review process to ensure secure baseline configurations (sbc) are current and applicable (e.g., system configuration settings and associated documentation).
- E-AST-13 Secure Baseline Configurations - Cloud-Based Services. Secure baseline configurations for all deployed types of cloud-based services or applications.
- E-AST-14 Secure Baseline Configurations - Databases. Secure baseline configurations for all deployed types of databases.
- E-AST-15 Secure Baseline Configurations - Embedded Technologies. Secure baseline configurations for all deployed types of embedded technologies.
- E-AST-16 Secure Baseline Configurations - Major Applications. Secure baseline configurations for all deployed types of major applications.
- E-AST-17 Secure Baseline Configurations - Minor Applications. Secure baseline configurations for all deployed types of minor applications.
- E-AST-18 Secure Baseline Configurations - Mobile Devices. Secure baseline configurations for all deployed types of mobile devices.
- E-AST-19 Secure Baseline Configurations - Network Devices. Secure baseline configurations for all deployed types of network devices.
- E-AST-20 Secure Baseline Configurations - Server Class Systems. Secure baseline configurations for all deployed types of server-class operating systems.
- E-AST-21 Secure Baseline Configurations - Workstation Class Systems. Secure baseline configurations for all deployed types of workstation-class operating systems.
- E-IAC-06 Authenticate, Authorize and Audit (AAA) Solution. An authenticate, authorize and audit (aaa) solution (on-premises and hosted by external service providers (esp)).
- E-IAC-07 Account Management Compliance Reviews. Account management compliance reviews.
- E-IAC-08 Conditions for Group / Role Membership. Conditions for group and role membership.
- E-IAC-12 Account Management Documentation. List of account management practices.
- E-IAC-13 Authenticator Types. System authenticator types.
- E-IAC-17 Authenticator Configuration Settings. Authenticator management settings (e.g., password complexity, default authenticator changes, account lockout, protection of authenticators).
- E-MON-11 System Authenticator Types. The list of authorized system authenticator types.
Alongside these, keep the System Security Plan (SSP) narrative for 03.05.07 recording the ODP values you adopted.
Timeline Considerations for NIST 800-171 R3 03.05.07
With four (4) AOs mapping directly, two indirectly, two net new, and two with no clear mapping, 03.05.07 is a moderate to significant lift. A realistic sequence:
- Define the list-update frequency (A.03.05.07.ODP[01], at least quarterly for DoD) and the composition and complexity rules (A.03.05.07.ODP[02], a sixteen-character minimum for DoD).
- Stand up the list of commonly used, expected, or compromised passwords and its update process (A.03.05.07.a[01] through a[03]).
- Screen new and changed passwords against the list (A.03.05.07.b).
- Confirm cryptographic protection in transit and storage (A.03.05.07.c and d), the new-password-after-recovery behavior (e), and the enforced rules (f).
- Collect evidence for all ten (10) AOs, including the list, its update records, screening configuration, and the enforced rules.
Frequently Asked Questions About NIST 800-171 R3 03.05.07
What value does the DoD require for the first parameter in NIST 800-171 R3 03.05.07? R3 leaves the value to the organization. For the DIB, the DoD set it in the 10 April 2025 memorandum under ODP identifier 03.05.07.a: at least quarterly.
How many assessment objectives does NIST 800-171 R3 03.05.07 have? NIST 800-171A R3 breaks 03.05.07 into ten (10) assessment objectives: two (2) Organization-Defined Parameters (ODPs) and eight (8) determination statements. An assessor works through each one separately, so each needs its own evidence.
Which NIST 800-53 R5 control does NIST 800-171 R3 03.05.07 come from? IA-05(01).
Where does NIST 800-171 R3 03.05.07 sit in the NIST 800-171 R3 Kill Chain? Phase 12, Secure Baseline Configurations (SBC) for parts c, d, e, f; Phase 13, Identity & Access Management (IAM) for parts a, b. The Kill Chain is a phased model for sequencing R3 implementation, and it assigns this requirement to that phase.
Bottom Line on NIST 800-171 R3 03.05.07
03.05.07 Password Management screens passwords against a breach and common-password list, protects them in transit and storage, requires a new password after recovery, and enforces defined composition rules. It maps from R2 3.5.7, 3.5.9, and 3.5.10, but the breach-list screening is net new and four of ten (10) objectives are significant effort. The recurring problem is keeping old complexity-and-rotation habits and missing the list. Build the common-password list, screen against it, use a sixteen-character minimum for DoD, and protect passwords cryptographically.
Authoritative sources:
Authoritative sources:
This guide reproduces U.S. Government text from NIST 800-171 R3 and NIST 800-171A R3 and references the DoD ODP memorandum of 10 April 2025. It is educational, not legal or assessment advice. Last reviewed: 2026-09-22.
