id: pwpolicy_account_lockout_enforce
title: Limit Consecutive Failed Login Attempts to $ODV
discussion: |
  The system _MUST_ be configured to limit the number of failed login attempts to a maximum of $ODV. When the maximum number of failed attempts is reached, the system _MUST_ prevent logins for a period of time after.

  This rule protects against malicious users attempting to gain access to the system via brute-force hacking methods.
references:
  nist:
    cce:
      macos_27:
        - CCE-XXXXX-xpath
      macos_26:
        - CCE-95337-2
      macos_15:
        - CCE-94331-6
      macos_14:
        - CCE-92927-3
      ios_27:
        - CCE-XXXXX-X
      ios_26:
        - CCE-96704-2
      ios_18:
        - CCE-94473-6
      ios_17:
        - CCE-93456-2
      visionos_27:
        - CCE-XXXXX-X
      visionos_26:
        - CCE-96715-8
    800-53r5:
      - AC-7
    800-171r3:
      - 03.01.08
  disa:
    cci:
      - CCI-000044
      - CCI-002238
    srg:
      - SRG-OS-000329-GPOS-00128
      - SRG-OS-000021-GPOS-00005
    disa_stig:
      macos_26:
        - APPL-26-000022
      macos_15:
        - APPL-15-000022
      macos_14:
        - APPL-14-000022
      ios_26:
        - AIOS-26-006900
      ios_18:
        - AIOS-18-006900
      ios_17:
        - AIOS-17-006900
        - AIOS-17-706900
      visionos_26:
        - AVOS-26-006900
    cmmc:
      - AC.L2-3.1.8
  cis:
    benchmark:
      macos_26:
        - 5.2.1 (level 1)
      macos_15:
        - 5.2.1 (level 1)
      macos_14:
        - 5.2.1 (level 1)
      ios_26:
        - 2.4.6 (level 1 - End-User Owned Devices)
        - 3.4.6 (level 1 - Institutionally-Owned Devices)
      ios_18:
        - 2.4.6 (level 1 - End-User Owned Devices)
        - 3.4.6 (level 1 - Institutionally-Owned Devices)
      ios_17:
        - 2.4.6 (level 1 - End-User Owned Devices)
        - 3.4.6 (level 1 - Institutionally-Owned Devices)
    controls_v8:
      - 6.2
  bsi:
    indigo:
      ios_26:
        - ANNEX D (Section 5.9.1 - Device-Code)
        - ANNEX K
      ios_18:
        - ANNEX D (Section 5.9.1 - Device-Code)
        - ANNEX K
      ios_17:
        - ANNEX D (Section 5.9.1 - Device-Code)
        - ANNEX K
platforms:
  macOS:
    '27.0': {}
    '26.0':
      benchmarks:
        - name: cis_lvl1
        - name: cis_lvl2
        - name: disa_stig
          severity: medium
    '15.0':
      benchmarks:
        - name: cis_lvl1
        - name: cis_lvl2
        - name: disa_stig
          severity: medium
    enforcement_info:
      check:
        shell: /usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeMaximumFailedAuthentications"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1 <= $ODV) {print "pass"} else {print "fail"}}' | /usr/bin/uniq
        result:
          string: pass
    introduced: '10.7'
  iOS:
    '27.0':
      supervised: false
    '26.0':
      supervised: false
      benchmarks:
        - name: cis_lvl1_byod
        - name: cis_lvl2_byod
        - name: cis_lvl1_enterprise
        - name: cis_lvl2_enterprise
        - name: ios_stig
          severity: medium
        - name: indigo_base
          severity: medium
        - name: indigo_high
          severity: medium
    '18.0':
      supervised: false
      benchmarks:
        - name: cis_lvl1_byod
        - name: cis_lvl2_byod
        - name: cis_lvl1_enterprise
        - name: cis_lvl2_enterprise
        - name: ios_stig
          severity: medium
        - name: indigo_base
          severity: medium
        - name: indigo_high
          severity: medium
    '17.0':
      supervised: false
      benchmarks:
        - name: cis_lvl1_byod
        - name: cis_lvl2_byod
        - name: cis_lvl1_enterprise
        - name: cis_lvl2_enterprise
        - name: ios_stig
          severity: medium
        - name: ios_stig_byoad
          severity: medium
        - name: indigo_base
          severity: medium
        - name: indigo_high
          severity: medium
    introduced: '4.0'
  visionOS:
    '27.0':
      supervised: false
    '26.0':
      supervised: false
      benchmarks:
        - name: visionos_stig
          severity: medium
    introduced: '2.0'
odv:
  hint:
    datatype: number
    description: Number of failed attempts, e.g. 3
    validation:
      min: 1
  recommended: 6
  cis_lvl1: 5
  cis_lvl2: 5
  cis_lvl1_byod: 6
  cis_lvl2_byod: 6
  cis_lvl1_enterprise: 6
  cis_lvl2_enterprise: 6
  ios_stig: 10
  ios_stig_byoad: 10
  indigo_base: 10
  indigo_high: 10
  visionos_stig: 10
  disa_stig: 3
tags:
  - 800-171
  - 800-53r5_low
  - 800-53r5_moderate
  - 800-53r5_high
  - cisv8
  - cnssi-1253_low
  - cnssi-1253_high
  - cmmc_lvl2
  - cnssi-1253_moderate
  - cmmc_lvl1
  - cmmc_lvl3
mobileconfig_info:
  - PayloadType: com.apple.mobiledevice.passwordpolicy
    PayloadContent:
      - maxFailedAttempts: $ODV
ddm_info:
  declarationtype: com.apple.configuration.passcode.settings
  ddm_key: MaximumFailedAttempts
  ddm_value: $ODV
