NIST SP 800-53 Rev. 5 · Access Control
AC-7 — Unsuccessful Logon Attempts
Repeated failed sign-ins without lockout. Published queries for three platforms, each with the evidence it needs and the limits of what it shows.
Why this matters
An account under password-guessing attack that was never locked
Locking an account after a number of failed sign-in attempts is one of the oldest protections in computing. When it is misconfigured — which is common — an attacker can guess passwords indefinitely. Nothing visibly breaks, so the gap can persist for years.
Why this check earns its place. The value is in the distinction the check makes. Reporting every attacked account would be useless noise; this reports only accounts where the protection failed to engage.
- What it reads
- The organization's own sign-in records.
- What it reports
- Accounts that passed the organization's own limit on failed attempts without the system locking them.
See related public disclosures on the Signals page →
The requirement
The organization must enforce a limit of consecutive invalid logon attempts by a user during an organization-defined time period, and automatically lock the account, delay the next prompt, or take another organization-defined action when that limit is exceeded.
NIST SP 800-53 Rev. 5 — AC-7 (Unsuccessful Logon Attempts).
NIST requires that a limit exist and that exceeding it triggers a response. The attempt threshold, the counting window, and what happens on breach are all organization-defined — NIST prescribes no numbers. This pack reports accounts whose failures passed your stated threshold with no lockout recorded afterwards, which evidences whether the limit you defined is actually being enforced.
What a check finds
An account exceeded the defined consecutive-failure threshold within the counting window, and no lockout was recorded during the burst or in the hour following it.
Choose your platform
CISA performance goals
- 3.E — Monitor unsuccessful (automated) login attempts
- 3.B — Establish minimum password strength (partial)
What a result does not prove
Failed sign-ins do not establish that an attack occurred or that any account was compromised. They establish that the organization's own attempt limit was not evidenced as enforced for that account in that window. A stuck client, an expired cached credential, or a misconfigured service can produce the same pattern.