Unsuccessful Logon Attempts AC-7

Access Control · Low baseline ✗ Not implemented

Status — program-wide

What references this control

No risks name this control in their Framework field yet.

No policies reference it yet.

Link a risk or policy to this control

Attaching adds AC-7 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.

Source: NIST SP 800-53 Rev.5, Access Control family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

AC-7 (Unsuccessful Logon Attempts) requires the system to limit consecutive failed login attempts and then respond - locking the account or the source for a set time, or until an admin unlocks it. It blunts password guessing and brute-force attacks, and applies from the Low baseline up.

What good looks like

Define a maximum number of failed attempts and the window they are counted over.
On exceeding the limit, lock the account or block the source for a defined period (or until manual unlock).
Apply the limit at both the operating-system and application layers.
Log lockout events so repeated failures are visible for review.

Framework mapping

NIST CSF 2.0 — PR.AA-03 — Users and services are authenticated, with abuse of the login path constrained
CIS Controls v8 — Control 6 — Access Control Management - protect the authentication path
OWASP Top 10:2021 — A07 Identification and Authentication Failures — Limit or delay repeated failed logins to resist brute force

How to move it toward Implemented

This is met on VM 607: the Fail2Ban sshd jail bans after maxretry 5 for bantime 1h over a findtime 10m window, and the SSH (Secure Shell) daemon caps a session at MaxAuthTries 3.
The required negative test - the source banned after 5 failed SSH logins - proves the lockout actually fires rather than just being configured.
Attach fail2ban-client status sshd output plus the ban-event log line as asset-scoped evidence naming AC-7 in the Requirement field to reach 'Completed'.