Requirements / Identification and Authentication (IA)
IA.L2-3.5.9
Temporary Passwords
Official Source Material
Allow temporary password use for system logons with an immediate change to a permanent password.
Determine if:
- [a] an immediate change to a permanent password is required when a temporary password is used for system logon.
Source: CMMC Assessment Guide - Level 2, Version 2.13, September 2024
Practitioner Guidance
How to meet it
One checkbox meets the objective where directories are involved.
Requiring a password change at next sign-in is the entire technical implementation of [a] in Active Directory and Microsoft Entra ID. Set it on every account created or reset with a temporary password. Make it a step in the account creation and reset procedures so it is never optional.
Where the platform cannot force the change, procedure plus justification carries it.
Some local accounts and some virtual desktop first-logon flows cannot enforce a change at first use. Document why the enforcement is unavailable and the instruction users follow instead. An explained gap with a procedure reads as an implementation. An unexplained one reads as a miss.
Make the temporary password worthless after first use.
Generate it randomly per user instead of a predictable house pattern, deliver it through a separate channel, and expire it if it goes unused. The new permanent password then has to meet the IA.L2-3.5.7 rules, which is the point of forcing the change immediately.