Independent DIB implementation resource — not affiliated with or endorsed by the U.S. Department of WarView the official DoW campaign ↗
Brilliant at the BasicsDIB Resource Center
3.5.9OFFICIAL STATEMENT BELOWDERIVED REQUIREMENTPENDING NIST SME REVIEW

3.5.9 — Temporary password handling

3.5 Identification and Authentication · NIST SP 800-171 Rev. 2 · The heading label is this site's navigational shorthand; the official language is the statement below.

Official requirement statement (verbatim)

Allow temporary password use for system logons with an immediate change to a permanent password.

NIST SP 800-171 Rev. 2 — Protecting CUI in Nonfederal Systems ↗NIST SP 800-171A — Assessing Security Requirements for CUI ↗
Independent interpretation

What this requirement is after

A temporary password issued for onboarding or reset is a shared secret in transit; it may be used only to reach the change-it-now screen. Provisioning flows must force an immediate change to a permanent authenticator on first logon.

Mapped practices

Brilliant at the Basics practices that support this requirement

No practice maps to this requirement — deliberately.

The campaign’s twenty practices are a priority list, not a control catalog, and none of them works this requirement’s substance directly. It still applies to you if it is in your contract’s scope: address it through your own implementation and the related artifacts below, and treat the absence of a mapping here as honesty, not permission to skip it.

Doing the work

Implementation considerations and evidence

Implementation considerationsIndependent guidance — tailor to your environment
  • Use the identity provider's built-in first-logon-change and time-boxed temporary access features rather than emailing passwords that live for a week.
  • Time-limited one-time enrollment links or Temporary Access Passes satisfy the intent more cleanly than human-relayed temporary passwords.
What operating evidence looks likeRecords worth retaining, not a submission checklist
  • Provisioning-flow configuration showing forced change on first use
  • A sampled onboarding record demonstrating the flow
Artifacts

Templates and worksheets with a mapped relationship

No artifact in the library names this requirement yet. The library index groups everything by category and practice.

The other revision

Where this lands in Rev. 3

Provenance

Sources and review status

Primary sourcesNIST SP 800-171 Rev. 2 — Protecting CUI in Nonfederal Systems · NIST SP 800-171A — Assessing Security Requirements for CUI
Review statusPending NIST SME review
Content version1.0
Updated