NIST 800-53 REV 5 • IDENTIFICATION AND AUTHENTICATION
IA-5(4) — Automated Support for Password Strength Determination
CMMC Practice Mapping
No direct CMMC mapping
NIST 800-171 Mapping
No direct NIST 800-171 mapping
Related Controls
No related controls listed
Practitioner Notes
This enhancement requires automated tools to check password strength — the system should reject weak passwords automatically, not rely on users to choose strong ones.
Example 1: Enable Azure AD Password Protection to automatically block passwords that contain dictionary words, repeated characters, or patterns found in breach databases.
Example 2: Configure your Linux PAM password quality module (pam_pwquality) to enforce minimum length, character diversity, and dictionary word checks at password change time.