or more assess or correct the documented deficiencies. (5.6) process(es) for OR password-only The Responsible Entity authentication for has implemented one interactive user or more documented access but did not process(es) for technically or password-only procedurally authentication for enforce password interactive user access changes or an but did not technically obligation to or procedurally enforce change the password changes or an password within obligation to change 17 calendar the password within 18 months but less calendar months of the than or equal to 18 last password change calendar months of and did not identify, the last password assess, or correct the change and has deficiencies. (5.6) identified OR deficiencies but did not assess or The Responsible Entity correct the has implemented one deficiencies. (5.6) or more documented process(es) for System OR Access Control but, The Responsible where technically Entity has feasible, did not either implemented one limit the number of or more unsuccessful documented authentication attempts process(es) for or generate alerts after password-only a threshold of authentication for unsuccessful interactive user authentication attempts access but did not and has identified technically or deficiencies but did not procedurally enforce password
or more documented process(es) for password-only authentication for interactive user access but did not technically or procedurally enforce password changes or an obligation to change the password within 17 calendar months but less than or equal to 18 calendar months of the last password change and has identified deficiencies but did not assess or correct the deficiencies. (5.6) OR The Responsible Entity has implemented one or more documented process(es) for password-only authentication for interactive user access but did not technically or procedurally enforce password assess or correct the deficiencies. (5.6) OR The Responsible Entity has implemented one or more documented process(es) for password-only authentication for interactive user access but did not technically or procedurally enforce password changes or an obligation to change the password within 18 calendar months of the last password change and did not identify, assess, or correct the deficiencies. (5.6) OR The Responsible Entity has implemented one or more documented process(es) for System Access Control but, where technically feasible, did not either limit the number of unsuccessful authentication attempts or generate alerts after a threshold of unsuccessful authentication attempts and has identified deficiencies but did not