Password reuse must be prevented

Control Statement: The instance must retain password history and prevent a user from reusing a recent password.

Description: The PasswordHistoryRecordCount system setting defines how many previous passwords are retained and compared against when a user sets a new one. This control requires the setting to be configured to a non-zero value consistent with the organisation’s documented policy.

Rationale: Password history is what makes a credential change meaningful. Without it, a user required to change a password after a suspected compromise may set the compromised password again, and the change that was supposed to remediate the incident restores the exact condition it was meant to end. This matters independently of whether the organisation enforces periodic expiry — current guidance discourages routine forced rotation, but reuse prevention remains necessary precisely for the changes that are not routine.

Audit Procedure:

1. Open System Designer → System settings.
2. Locate the setting with code PasswordHistoryRecordCount and record its configured value.
3. Record the instance as non-compliant if the value is unset or zero, or if it is lower than the organisation’s documented policy.
4. Where authentication is delegated to an external identity provider, verify the equivalent policy at that provider instead.

Remediation:

1. Determine the required history depth from the organisation’s password policy.
2. Set PasswordHistoryRecordCount to that value.
3. Verify enforcement by attempting to reset a test account’s password to its current value.

Default Value: Creatio treats this value as organisation-dependent and does not document the value carried before configuration. An instance where it has never been configured should be assumed not to prevent reuse until verified.