Prohibit password reuse for a specified number of generations
📖 What This Means
This control ensures that users cannot reuse their previous passwords for a certain number of password changes. For example, if the policy specifies that users cannot reuse the last 10 passwords, they must create a new password that hasn't been used in the last 10 iterations. This reduces the risk of unauthorized access if an old password is compromised. Think of it like locking a door with a new key every time; even if someone finds an old key, it won't work. This practice is especially important for accounts with access to sensitive defense-related information.
🎯 Why It Matters
Password reuse is a major security risk because attackers often exploit old passwords gained from breaches or phishing attacks. For example, in the 2012 LinkedIn breach, millions of passwords were leaked, and attackers reused them to access other accounts. In a defense contractor context, reused passwords could lead to unauthorized access to classified systems, resulting in data theft, operational disruption, or compliance penalties. The DoD emphasizes this control to ensure that even if a password is compromised, it cannot be reused, thereby protecting sensitive information.
✅ How to Implement
- 1. In Azure, navigate to Azure Active Directory > Password Reset > Password Policy. Set 'Enforce password history' to the desired number (e.g., 10).
- 2. For AWS, use AWS IAM Password Policies. Enable 'Prevent password reuse' and specify the number of previous passwords to remember.
- 3. In GCP, go to IAM & Admin > Settings > Password Policy. Configure 'Password reuse prevention' to the required number.
- 4. Ensure MFA is enabled alongside password policies for added security.
- 5. Regularly audit compliance using cloud-native tools like Azure Security Center or AWS Config.
📋 Evidence Examples
Password Policy Document
Active Directory Password Policy Screenshot
Password Reset Log
Test Results
Training Records
📝 SSP Guidance
Use this guidance when writing the System Security Plan (SSP) narrative for this control.
How to Write the SSP Narrative
For IA.L2-3.5.8 ("Prohibit password reuse for a specified number of generations"), your SSP narrative should specifically describe: (1) the tools and technologies you use to implement this control, (2) the configuration or process that enforces it, (3) who is responsible for maintaining it, and (4) what evidence proves it's working. Describe how users, devices, and processes are identified and authenticated, including your IAM platform, password policies, MFA implementation, certificate management, and service account controls. Be specific -- name your actual products, settings, and responsible personnel.
Example SSP Narratives
"IA.L2-3.5.8 is implemented using cloud-native controls. [Organization] uses [specific cloud service/feature] to prohibit password reuse for a specified number of generations. The configuration is managed through [Azure Policy/AWS Config/Terraform] and monitored via [SIEM tool]. Responsible party: [IT Security Manager]. Evidence: [specific artifact, e.g., 'Azure AD Conditional Access policy screenshot, CloudTrail logs']."
"IA.L2-3.5.8 is implemented through on-premise infrastructure controls. [Organization] uses [Active Directory/Group Policy/specific tool] to prohibit password reuse for a specified number of generations. Configuration is documented in [location] and audited [frequency]. Responsible party: [System Administrator]. Evidence: [specific artifact, e.g., 'Group Policy export, Windows Event logs']."
"IA.L2-3.5.8 is implemented across both cloud and on-premise environments. [Organization] uses [Azure AD Connect/hybrid tool] to ensure consistent enforcement. Cloud resources are managed via [cloud tool] and on-premise systems via [on-prem tool]. Both environments report to [centralized SIEM]. Responsible party: [IT Director]. Evidence: [artifacts from both environments]."
System Boundary Considerations
- • Identify all authentication entry points (local login, VPN, cloud, API)
- • Document the identity provider(s) and authentication flow
- • Specify MFA methods and coverage
- • Ensure this control covers all systems within your defined CUI boundary where prohibit password reuse for a specified number of generations applies
- • Document any systems where this control is not applicable and explain why
Key Documentation to Reference in SSP
- 📄 Identification and Authentication Policy
- 📄 Password policy configuration
- 📄 MFA enrollment records
- 📄 Service account registry
- 📄 Evidence artifacts specific to IA.L2-3.5.8
- 📄 POA&M entry if control is not fully implemented
What the Assessor Looks For
The assessor will test authentication mechanisms, verify MFA is enforced for required access paths, check password policy configuration, and review service account documentation.
💬 Self-Assessment Questions
Use these questions to assess your compliance. Each "NO" answer provides specific remediation guidance.
Question 1: Is there a documented password policy that prohibits password reuse?
Question 2: Is the password reuse prevention setting configured in your authentication system?
Question 3: Have you tested the password reuse prevention mechanism?
Question 4: Are all users trained on the password reuse policy?
Question 5: Is the policy enforced for both privileged and non-privileged accounts?
⚠️ Common Mistakes (What Auditors Flag)
1. Not applying the policy to privileged accounts.
2. Incorrectly configuring the password history count.
3. Lack of documentation.
4. Not testing the mechanism.
5. Failing to train users.
📚 Parent Policy
This practice is governed by the Identification and Authentication Policy