1Overview
IA.L2-3.5.10 is the family's third five-point requirement and it protects the passwords themselves. It requires that the organization store and transmit only cryptographically-protected passwords, so that passwords are never held or sent in a form an attacker could simply read. It is a five-point requirement that cannot be deferred on a plan of action.
A password is only as safe as the way it is stored and sent. If passwords sit in a database in plaintext, or travel across the network unprotected, a single breach or intercept hands an attacker working credentials for every account. This control requires cryptographic protection in both states: at rest, passwords are hashed rather than stored readable, and in transit, they move over encrypted channels. Its five-point weight reflects that unprotected passwords turn any data exposure into a full account compromise.
Store and transmit only cryptographically-protected passwords.
The requirement covers two states: storage and transmission. In storage, passwords should be protected by a one-way cryptographic hash, so that even someone with the stored data cannot recover the passwords. In transmission, passwords should travel only over encrypted channels, so they cannot be read in transit. Modern directories and applications generally hash stored passwords and use encrypted protocols by default, so the control is often met by using current systems correctly and by ensuring no legacy path handles passwords in the clear.
2The Assessment Objectives
NIST SP 800-171A decomposes 3.5.10 into two objectives: protect passwords in storage and in transit.
Passwords are cryptographically protected in storage. Stored passwords are not readable.
Passwords are cryptographically protected in transit. Passwords are not sent in the clear.
The two objectives cover the two states passwords occupy. The common gap is a legacy application or protocol that stores passwords reversibly or transmits them unencrypted, even when the main directory does neither. The assessor looks for cryptographic protection in both storage and transit, with no unprotected path.
3Failure Patterns
The failures are about plaintext storage and unencrypted transmission, usually in legacy paths.
Passwords stored readable
An application that stores passwords in plaintext or a reversible form fails objective [a], because anyone reaching the store gains the passwords. Hashing stored passwords is what protects them at rest.
Passwords sent in the clear
A protocol or application that transmits passwords unencrypted exposes them to interception, failing objective [b]. Encrypted channels for authentication are what protect passwords in transit.
Legacy systems bypassing protection
Even where the main directory protects passwords, a legacy system that stores or sends them unprotected creates a weak path. Every system that handles passwords has to protect them in both states.
Reversible encryption instead of hashing
Storing passwords with reversible encryption rather than a one-way hash means they can be recovered by whoever holds the key, which does not meet the intent of protecting stored passwords. Hashing is the appropriate protection at rest.
4Ownership
This is an IT-owned technical control, delivered through how systems store and transmit passwords.
| Role | Responsibility for this control |
|---|---|
| IT and system administrator | Ensures passwords are hashed in storage and encrypted in transit across systems, including legacy ones. Owns the technical evidence. |
| Security or compliance lead | Confirms no system stores or transmits passwords unprotected. |
| Program lead | Includes password handling in periodic review and retains the evidence. |
5Tooling
The control is delivered by password hashing at rest and encrypted channels in transit.
| Objectives | Tooling | What it provides |
|---|---|---|
| [a] | Password hashing in the directory and applications | Stored passwords held as one-way hashes. |
| [b] | Encrypted authentication channels | Passwords transmitted only over encrypted connections. |
| Coverage | Review of legacy password handling | Identification of any path that stores or sends passwords unprotected. |
The caveat is that protection has to cover every system, since one legacy path handling passwords in the clear undermines the control. Modern systems generally protect passwords by default, so the work is finding and closing the exceptions. The assessor examines storage and transmission across systems, so no unprotected path can remain.
6Evidence
The satisfied version of 3.5.10 shows passwords protected in both storage and transit.
| Evidence | What it demonstrates |
|---|---|
| Password storage configuration | Objective [a]. Passwords hashed in storage. |
| Authentication channel configuration | Objective [b]. Passwords transmitted over encrypted channels. |
| Legacy handling review | Objectives [a], [b]. No system handles passwords unprotected. |
The evidence should show passwords hashed at rest and encrypted in transit with no unprotected path. The storage and channel configuration, together with a review of legacy handling, is the clearest demonstration, and because this control cannot sit on a plan of action, the protection has to be real at the time of assessment.
Unprotected passwords turn any breach into a break-in
Passwords stored readable or sent in the clear hand an attacker working credentials from a single exposure, and this five-point control requires cryptographic protection in both states. Finding and closing the legacy paths that handle passwords unprotected is part of the onsite readiness work this practice does, and it is one of the controls that must be met rather than deferred.
Start CMMC Readiness or call 802-335-26627Sources
- NIST Special Publication 800-171 Rev 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, requirement 3.5.10. csrc.nist.gov
- NIST Special Publication 800-171A, Assessing Security Requirements for Controlled Unclassified Information, assessment objectives 3.5.10[a] and 3.5.10[b]. csrc.nist.gov
- 32 CFR 170.24, CMMC Scoring Methodology, listing IA.L2-3.5.10 among the five-point derived security requirements. ecfr.gov