FedRAMP Controls / AC

AC-7 Unsuccessful Logon Attempts

Family AC
Baselines moderate
Mapped KSIs 2

Control statement

a. Enforce a limit of {{ insert: param, ac-07_odp.01 }} consecutive invalid logon attempts by a user during a {{ insert: param, ac-07_odp.02 }} ; and
    b. Automatically {{ insert: param, ac-07_odp.03 }} when the maximum number of unsuccessful attempts is exceeded.
        Requirement: In alignment with NIST SP 800-63B

Parameter placeholders {{ insert: param, … }} reference FedRAMP-set values in the resolved profile. Full parameter map is preserved in the catalog database.

Covered by these Key Security Indicators

KSITitleCategory
KSI-IAM-04Just-in-Time Authorization
Use a least-privileged, role and attribute-based, and just-in-time security authorization model for all user and non-user accounts and services.
Identity and Access Management
KSI-IAM-06Suspicious Activity
Automatically disable or otherwise secure accounts with privileged access in response to suspicious activity
Identity and Access Management