Thank you, Eric.




From: Public [] On Behalf Of Eric Mill via 
Sent: Thursday, May 17, 2018 10:43 AM
To: Geoff Keating <>; CA/Browser Forum Public Discussion List 
Subject: Re: [cabfpub] Ballot 221 v3: Two-Factor Authentication and Password 


FedRAMP has published guidance about the new NIST password/identity guidelines:


They note that the formal baseline is still not updated, but encourage folks to 
follow NIST's new guidance regardless:


NOTE: At the time of this document’s publication, FedRAMP Moderate and High 
controls IA-5 (g)

and IA-5 (1) (a,d) are known to be more restrictive than the new password 
requirements in 800-

63B, AAL2 and AAL3 respectively. FedRAMP recommends Agency AOs accept 
compliance with

NIST’s guidance that is most up-to-date and consistent with current cyber 
security threats. This

may be done using an implementation status of “Alternative Implementation.”


I also confirmed with the FedRAMP program that the baseline is expected to be 
updated to match NIST's SP 800-63, and thus avoid the need for any special 
acceptance. But the point is that FedRAMP is not an obstacle to dropping 
password rotation -- they are expecting service providers to follow NIST's 
guidance and drop it.


-- Eric


On Tue, May 15, 2018 at 6:48 PM, Geoff Keating via Public < 
<> > wrote:

> On May 15, 2018, at 8:37 AM, Patrick Tronnier via Public < 
> <> > wrote:
> I want to make it clear that OATI agrees with the minimum 2 year password 
> period as the more secure route. It is FedRAMP and other standards which 
> don’t. J

I've been looking at FedRAMP, because I was surprised they'd be putting out 
guidelines that conflict with NIST guidelines, and I can't find this 
requirement; for the 'high security controls' 
 it does require you have a minimum and maximum password lifetime in 
IA-05(1)(d), but it says the actual limits are organization-defined, so you can 
ask the organization to set the maximum lifetime to, say, 3 years.

Public mailing list <>



Eric Mill

Senior Advisor, Technology Transformation Services

Federal Acquisition Service, GSA <> , +1-617-314-0966

Attachment: smime.p7s
Description: S/MIME cryptographic signature

Public mailing list

Reply via email to