Accounts must be locked after repeated failed authentication attempts

Control Statement: The instance must lock an account after a bounded number of consecutive failed authentication attempts, for a defined period.

Description: Creatio expresses lockout through LoginAttemptCount, the number of consecutive failed attempts permitted before an account is locked, and UserLockoutDuration, the period for which it remains locked. This control requires both to be configured: a bounded attempt count, and a non-zero duration. Creatio’s own guidance recommends 5 attempts and a 15-minute lockout.

Rationale: Lockout is what makes password strength matter. Every other authentication control in this category raises the cost of a single guess; without a bound on attempts, an attacker is free to make an unlimited number of them, and the practical strength of the password policy collapses to whatever can be exhausted in the available time. Both settings are required for the control to function — an attempt count with a zero duration produces a lock that lifts immediately, which reads as configured on the settings screen while providing no throttling at all.

Audit Procedure:

1. Open System Designer → System settings.
2. Record the configured values of LoginAttemptCount and UserLockoutDuration.
3. Record the instance as non-compliant if LoginAttemptCount is unset or zero, meaning attempts are unbounded, or exceeds the organisation’s documented threshold.
4. Record the instance as non-compliant if UserLockoutDuration is unset or zero.
5. Where authentication is delegated to an external identity provider, verify the equivalent policy at that provider instead.

Remediation:

1. Set LoginAttemptCount to the organisation’s documented threshold, using 5 as a reference point.
2. Set UserLockoutDuration to the documented period, using 15 minutes as a reference point.
3. Verify enforcement by exhausting the attempt count on a test account and confirming both that the lock applies and that it lifts only after the configured period.

Default Value: Creatio’s guidance recommends 5 attempts and a 15-minute lockout duration but does not document the values carried before configuration. Verify the effective behaviour on the instance rather than assuming lockout is active.