Notifications
Clear all
Topic starter
10/07/2026 9:18 pm
TL;DR: CMMC Level 2 shifts password security from policy language to enforceable controls across creation, reuse, reset, and ongoing monitoring, according to Enzoic. That means identity teams must treat weak and reused passwords as an operational exposure, not a documentation problem, if they want controls that hold up in assessments.
NHIMG editorial — based on content published by Enzoic: CMMC Level 2 Active Directory Continuous Password Protection Regulation and Compliance
By the numbers:
- 17 minutes, redentials are exposed publicly, attackers attempt access within an average of 17 minutes , and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: How should security teams enforce password rules beyond Active Directory defaults?
A: Use Active Directory as the baseline, then add exposure-aware screening, similarity blocking, and normalization at every point where a password is created or changed.
Q: Why do password history controls still allow risky reuse?
A: Password history only catches exact repeats.
Q: What breaks when password screening happens only after a breach?
A: The gap is time. A password may be valid today and exposed tomorrow, which means post-breach remediation always lags the real risk window. Continuous screening closes that gap by re-evaluating live credentials against new exposure data, so a safe-at-creation password does not become an unnoticed access path later.
Practitioner guidance
- Screen password changes against breached-password data Add exposure-aware screening to every password creation and reset path so compromised values are blocked before they are accepted in Active Directory or application login flows.
- Block near-reuse, not just exact reuse Combine history checks with similarity scoring, normalization, and root-password detection so trivial edits cannot satisfy password reuse requirements.
- Extend enforcement to all password entry points Apply the same controls to first-logon resets, administrator resets, custom IAM workflows, and partner portals so one weak path does not undermine the programme.
What's in the full article
Enzoic's full post covers the operational detail this post intentionally leaves for the source:
- How the Enzoic for Active Directory screening flow maps to password creation, reset, and change events
- The specific CMMC Level 2 requirement mapping for password complexity, reuse, and temporary password handling
- How similarity blocking, normalization, and root-password screening work together during enforcement
- The extension points for IAM APIs and login flows outside Active Directory
👉 Read Enzoic's analysis of CMMC Level 2 password control enforcement →
CMMC Level 2 password controls: are your checks actually enforceable?
Explore further
10/07/2026 9:41 pm
Continuous password enforcement is the real control, not password policy text. CMMC Level 2 exposes the difference between a documented rule and an enforceable one. If a password can be accepted even when it is reused, predictable, or already exposed, the control is not operating at the point of risk. Practitioners should evaluate whether the directory, reset flow, and monitoring layer all enforce the same standard.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap.
A question worth separating out:
Q: Who is accountable when weak passwords slip through compliance controls?
A: Accountability sits with the identity and security teams that own the authentication path, because CMMC and similar regimes judge the control by how it operates in practice. If passwords can be accepted without breach screening, the organisation does not just have a user behaviour problem, it has a control enforcement problem.
👉 Read our full editorial: CMMC Level 2 password controls need continuous enforcement
