Account Lockout
What is Account Lockout?
A security feature that temporarily disables a user account after a specified number of failed authentication attempts to prevent brute force attacks.
Terms that appear alongside account lockout
Each of these is named in at least one of the same controls as account lockout. The number is how many controls name both.
- authentication 6 shared controls
- credential stuffing 4 shared controls
- owasp 3 shared controls
- multi factor authentication 3 shared controls
- nist 3 shared controls
- oauth 2 shared controls
- audit 2 shared controls
- access control 2 shared controls
Frameworks that govern account lockout
What the standards actually require on account lockout
Requirements naming account lockout across 6 standards, quoted from the control text.
Cloud user account lockout. Levels 1 and 2 (a and b): lockout after six failed attempts and a lockout duration of at least 30 minutes; Level 3 is the same.
mtcs-singapore::23.5 · User account lockout →User accounts, except for break glass accounts, are locked out after a maximum of five failed logon attempts.
ISM-1403 · Account lockout after failed logons →All solutions have user-based access with unique client logins and authentication and authorisation controls (for example a unique username and password);
ato-digital-service-provider-dsp-operational-security-framework::SEC.AUTH.UNIQUE · Unique user logins, shared logins blocked →Cap the number of consecutive failed logon attempts allowed and take a defined action, such as account lockout, once that limit is reached.
AC.L2-3.1.8 · Unsuccessful Logon Attempts →Card and PIN issuance, in-house or contracted, is controlled by separating access to customer account information from PIN information, embossing and encoding in a secure area with inventory and accounting controls for card stock including test and reject card...
ffiec-it-examination-handbook::RPS-19 · Card/PIN Issuance (Retail Payment Systems) →RP ID + origin binding define the SCOPE of a credential. RP ID: an effective domain (e.g. example.com) - a credential created with rpId=example.com works for example.com + www.example.com + login.example.com but NOT for evil.com NOR sub.different.com.
FIDO2-RP-Identity · Relying Party Identifier, Origin Binding, Cross-Origin and Conditional UI →Questions people ask about account lockout
What is Account Lockout?
Why is Account Lockout important for compliance?
Which compliance frameworks address Account Lockout?
Where can I learn more about Account Lockout?
See how Account Lockout applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.