Independent DIB implementation resource — not affiliated with or endorsed by the U.S. Department of WarView the official DoW campaign ↗
Brilliant at the BasicsDIB Resource Center
3.5.8OFFICIAL STATEMENT BELOWDERIVED REQUIREMENTPENDING NIST SME REVIEW

3.5.8 — Password reuse prohibition

3.5 Identification and Authentication · NIST SP 800-171 Rev. 2 · The heading label is this site's navigational shorthand; the official language is the statement below.

Official requirement statement (verbatim)

Prohibit password reuse for a specified number of generations.

NIST SP 800-171 Rev. 2 — Protecting CUI in Nonfederal Systems ↗NIST SP 800-171A — Assessing Security Requirements for CUI ↗
Independent interpretation

What this requirement is after

Users must not rotate between a handful of favorite passwords. A remembered-history check blocks reuse for a specified number of generations wherever passwords are still the authenticator.

Across revisions

Withdrawn as a standalone item in Rev. 3; the consolidated Password Management requirement (03.05.07) governs.

Mapped practices

Brilliant at the Basics practices that support this requirement

No practice maps to this requirement — deliberately.

The campaign’s twenty practices are a priority list, not a control catalog, and none of them works this requirement’s substance directly. It still applies to you if it is in your contract’s scope: address it through your own implementation and the related artifacts below, and treat the absence of a mapping here as honesty, not permission to skip it.

Doing the work

Implementation considerations and evidence

Implementation considerationsIndependent guidance — tailor to your environment
  • Configure history in the directory or identity provider and record the number chosen.
  • The requirement fades in importance as accounts move to MFA and passwordless — but it applies wherever passwords survive, including appliances.
What operating evidence looks likeRecords worth retaining, not a submission checklist
  • Password-history configuration exports for each store where passwords are used
  • The written password standard naming the generation count and where it is enforced
Artifacts

Templates and worksheets with a mapped relationship

No artifact in the library names this requirement yet. The library index groups everything by category and practice.

The other revision

Where this lands in Rev. 3

Provenance

Sources and review status

Primary sourcesNIST SP 800-171 Rev. 2 — Protecting CUI in Nonfederal Systems · NIST SP 800-171A — Assessing Security Requirements for CUI
Review statusPending NIST SME review
Content version1.0
Updated