Password history prevents users from cycling through passwords repeatedly, using the same one they’ve been using forever. The idea is to force actual password changes over time. This is easily configured in Windows Group Policy or cloud identity providers.
Like password complexity (IA.L2-3.5.7), this is usually straightforward. The assessor checks your configuration, sees a reasonable number (typically 5-24 remembered passwords), and moves on. The failure is usually “I didn’t even know this was configurable” or “we never set it up.” Together with IA.L2-3.5.10 (cryptographic protection), these practices make up your password security posture.
What the assessor is actually evaluating
The assessor is checking that you have a password history requirement and that it’s enforced. They want to know how many previous passwords you remember. They’ll ask where you’ve configured this. If you say “I don’t know,” that’s a problem. If you say “we remember the last 10 passwords,” that’s fine.
The number itself is less important than the fact that you have one. NIST recommends at least 5. Most organizations use 10 or 24. Pick something reasonable and document it.
What a realistic SSP definition looks like
Practice IA.L2-3.5.8: Password Reuse Restrictions
Users cannot reuse recent passwords. Our password history requirement prevents users from cycling through old passwords repeatedly.
Domain Accounts:
Active Directory Group Policy enforces a password history requirement of [10 / 24] passwords. Users cannot set a new password to any of their previous [10 / 24] passwords. This is configured in the Password Policy Group Policy object applied to all domain-joined systems.
Cloud Accounts:
Azure AD password policy enforces a password history of at least [5 / 10] passwords. Users attempting to reuse a recent password are prompted to choose a different one.
Service Accounts:
Service account passwords are rotated every 90 days. New passwords are randomly generated and not reused from previous passwords. Service account password changes are documented in the credential vault audit logs.
Policy Review:
This password history requirement is reviewed annually as part of our security policy review. The configuration is validated against the Group Policy or identity provider settings to ensure it remains enforced.
Clear and simple. The assessor reads this and knows exactly where to look for evidence.
How to present your evidence
- Password policy document stating history requirement (e.g., 10 remembered passwords)
- Group Policy screenshot showing 'Enforce password history' configured
- Cloud identity provider policy screenshot showing password history setting
- Your SSP statement covering password reuse restrictions
You need:
Your password policy document. A written statement of your password history requirement (e.g., “we remember the last 10 passwords”).
Group Policy screenshot. If you use Windows, navigate to Account Policies > Password Policy and show the “Enforce password history” setting. Screenshot or export it.
Identity provider policy screenshot. If using cloud, show the password history setting from your identity provider admin panel.
That’s all the evidence you need. This is quick.
Keep answers short. Show the evidence, don't describe it. Let the assessor drive. For more on how to present in the assessment room, see How to Present Evidence in the Assessment Room.
Common failures
Short, practical breakdowns of what assessors actually ask and how to answer. No compliance jargon, no sales pitch. Subscribe free on Substack.
If you use an MSP or MSSP
Your MSSP configured this as part of your Group Policy setup. It should already be in place. Confirm it with them before the assessment.
This is not a practice where you expect customization. Standard domain configuration includes password history. If your MSSP hasn’t set it up, ask why.
This guidance is based on assessment room experience and reflects one practitioner’s interpretation of CMMC Level 2 requirements. It is not legal or compliance advice. Always consult your compliance team and official CMMC documentation for final guidance.