Requiring to take, and having devices implement, specific measures to safeguard authenticators. (1) The information system, for password-based authentication: (a) Enforces minimum password complexity of [Assignment: organization-defined requirements for case sensitivity, number of characters, mix of upper-case letters, letters, numbers, and special characters, including minimum requirements for each type]; (b) Enforces at a [Assignment: number of changed characters] when new passwords are created; (c) Encrypts passwords in storage and in transmission; (d) Enforces password minimum and maximum lifetime restrictions of [Assignment: organization-defined numbers for lifetime minimum, lifetime maximum]; and (e) Prohibits password reuse for [Assignment: organization-defined number] generations. IA-6 The information system obscures feedback of Authenticator Feedback authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals. IA-7 The information system uses mechanisms for Cryptographic Module authentication to a cryptographic module that meet the Authentication requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication. IA-8 The information system uniquely identifies and Identification and authenticates non-organizational users (or processes Authentication acting on behalf of non-organizational users). Users) Incident Response IR-1 The organization develops, disseminates, and Incident Response Policy reviews/updates [Assignment: organization-defined and Procedures frequency]: A formal, documented incident response policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and Formal, documented procedures to facilitate the implementation of the incident response policy and associated incident response controls. IR-2 The organization: The organization incorporates simulated Incident Response events into incident response training to Training
Requiring to take, and having devices implement, specific measures to safeguard authenticators. (1) The information system, for password-based authentication: (a) Enforces minimum password complexity of [Assignment: organization-defined requirements for case sensitivity, number of characters, mix of upper-case letters, letters, numbers, and special characters, including minimum requirements for each type]; (b) Enforces at a [Assignment: number of changed characters] when new passwords are created; (c) Encrypts passwords in storage and in transmission; (d) Enforces password minimum and maximum lifetime restrictions of [Assignment: organization-defined numbers for lifetime minimum, lifetime maximum]; and (e) Prohibits password reuse for [Assignment: organization-defined number] generations. IA-6 Authenticator Feedback The information system obscures feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals. IA-7 Cryptographic Module Authentication The information system uses mechanisms for authentication to a cryptographic module that meet the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication. IA-8 Identification and Authentication Users) The information system uniquely identifies and authenticates non-organizational users (or processes acting on behalf of non-organizational users). Incident Response IR-1 Incident Response Policy and Procedures The organization develops, disseminates, and reviews/updates [Assignment: organization-defined frequency]: A formal, documented incident response policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and Formal, documented procedures to facilitate the implementation of the incident response policy and associated incident response controls. IR-2 Incident Response Training The organization: The organization incorporates simulated events into incident response training to