What this requirement asks
Obscure feedback of authentication information.
This is a CMMC Level 2 requirement in the Identification & Authentication family, drawn from NIST SP 800-171 Rev. 2. An assessor evaluates it objective by objective — every objective below must be supported by evidence, not just described in a policy.
Assessment objectives (1)
- 3.5.11[a] — authentication information is obscured during the authentication process
What an assessor examines
Examine:
- Identification and authentication policy
- procedures addressing authenticator feedback
- system security plan
- system design documentation
- system configuration settings and associated documentation
- system audit logs and records
- other relevant documents or records
Interview:
- Personnel with information security responsibilities
- system or network administrators
- system developers
Test:
- Mechanisms supporting or implementing the obscuring of feedback of authentication information during authentication
Evidence that defends it
Show login errors are generic
Check your readiness
Score this requirement against your own environment with the Level 2 self-assessment checklist, or estimate your SPRS score with the free CMMC compliance tool. Self-reported answers are planning signals only — they do not establish a verified or assessor-accepted result.