Free compliance framework explorer — browse controls, evidence, and implementation guidance.Subscribe for updates →
SOC 247
ITSP.10.17198
ISO 42001soon
ISO 27001soon

Browse

98 controls

03.01.08Unsuccessful logon attemptsITSP.10.171Access control

Official Requirement

A. Limit the number of consecutive invalid logon attempts to [Assignment: organization-defined number] in [Assignment: organization-defined time period]. B. Automatically [Selection (one or more): lock the account or node for an [Assignment: organization-defined time period]; lock the account or node until released by an administrator; delay next logon prompt; notify system administrator; take other action] when the maximum number of unsuccessful attempts is exceeded.

Source: Canadian Centre for Cyber Security ITSP.10.171 (2025), adapted from NIST SP 800-171 Rev. 3

In Plain English

Your systems must limit the number of failed login attempts before locking the account or introducing a delay. This prevents brute-force password attacks. Define a threshold (e.g., 5 failed attempts in 15 minutes), and then either lock the account for a set period or introduce progressive delays.

Cross-framework mappings:ISO 42001 · coming soonISO 27001 · coming soon
View in Map →

Help us build what matters.

Vote for the next framework, subscribe for updates, and let us know if you'd contribute.

Truvo CyberTruvo CyberBuilt and maintained by Truvo Cyber
Authors·Connect with us
Updated: Mar 22, 2026Reviewed: Mar 22, 2026v1.0.0
Share this tool

The Trust Services Criteria referenced in this tool are published by the American Institute of Certified Public Accountants (AICPA) and incorporate principles from the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Criteria descriptions are reproduced for reference purposes. All implementation guidance, evidence recommendations, and control language are original work by Truvo Cyber. ISO 27001 and ISO 42001 are standards published by the International Organization for Standardization (ISO). Framework and standard names are the property of their respective owners. This tool is not affiliated with, endorsed by, or certified by AICPA, COSO, or ISO.

© 2026 Truvo Cyber. All rights reserved.

On-premises implementation and evidence

Account lockout after failed logon attempts

Implementation steps

  1. Configure Active Directory Account Lockout Policy via Group Policy (lockout threshold, lockout duration, reset counter)
  2. Set lockout threshold to a defined number of attempts (e.g., 5) and lockout duration (e.g., 30 minutes)
  3. Monitor account lockout events (Event ID 4740) in the SIEM and alert on patterns indicating brute-force attempts
  4. Document the lockout configuration in the access control policy with management approval

Tools / systems

Evidence artifacts

Evidence frequency: Continuous enforcement; quarterly policy review