Notifications
Clear all
Topic starter
11/07/2026 8:34 pm
TL;DR: CMMC password compliance largely mirrors NIST guidance, with IA.L2-3.5.9 requiring organisations to block dictionary words, repetitive patterns, and compromised passwords while continuously enforcing those checks, according to Enzoic. The real issue is not password policy wording but whether identity controls can prove ongoing enforcement across DoD-facing environments.
NHIMG editorial — based on content published by Enzoic: CMMC and NIST Password Compliance 101: Are They Different?
Questions worth separating out
Q: How should security teams enforce CMMC password requirements across multiple systems?
A: Security teams should enforce the same compromised-password check at every password creation or change point, including Active Directory, SaaS, and custom applications.
Q: Why do compromised passwords matter more than complex passwords for CMMC?
A: Compromised passwords matter more because attackers routinely reuse credentials from breach corpuses and credential-stuffing lists.
Q: What breaks when password policy is enforced only on one platform?
A: The control breaks at the first unmanaged system that still accepts weak or breached passwords.
Practitioner guidance
- Map every password creation path Inventory Active Directory, SaaS, custom apps, and any legacy interfaces that accept user passwords, then verify that each path performs the same compromised-password screening before acceptance.
- Replace composition-only rules Keep minimum length where needed, but remove dependence on dictionary and character-pattern complexity as the primary defence, because those rules do not stop breached credential reuse.
- Preserve audit evidence for enforcement Log each screening event, rejected password, and remediation action so auditors can verify the control is operational and continuously applied across the environment.
What's in the full article
Enzoic's full post covers the operational detail this post intentionally leaves for the source:
- How its Active Directory integration enforces compromised-password screening in real time.
- The exact IA.L2-3.5.9 password wording and how Enzoic maps it to NIST guidance.
- Examples of logging and reporting that can be used as audit evidence.
- API-driven enforcement patterns for non-Windows applications and custom systems.
👉 Read Enzoic's analysis of CMMC password compliance and NIST alignment →
CMMC password requirements: what IAM teams need to do differently?
Explore further
11/07/2026 9:02 pm
Compromised-password screening is the real control, not password complexity theatre. The article correctly surfaces the move from composition rules toward blocklists and breach-corpus checks. That aligns with modern identity practice because attackers do not need to guess a complex password if they can reuse one already exposed elsewhere. The practitioner conclusion is simple: if the control cannot block known-bad secrets at creation time, it is not doing the job.
A few things that frame the scale:
- Only 19.6% of security professionals express strong confidence in their organisation's ability to securely manage non-human workload identities, according to The 2024 Non-Human Identity Security Report.
- 88.5% of organisations acknowledge that their non-human IAM practices lag behind or are merely on par with their human identity and access management efforts.
A question worth separating out:
Q: Who is accountable when CMMC password compliance fails?
A: Accountability sits with the organisation that accepted the contract obligation, not just the team running the directory service. For DoD work, CMMC and its underlying NIST-derived controls require demonstrable enforcement, so gaps in monitoring, validation, or evidence can become audit and contractual issues for the contractor of record.
👉 Read our full editorial: CMMC password compliance is really NIST identity governance
