3.1.8 Limit unsuccessful logon attempts.

This requirement applies regardless of whether the logon occurs via a local or network connection. Due to the potential for denial of service, automatic lockouts initiated by systems are, in most cases, temporary and automatically release after a predetermined period established by the organization (i.e., a delay algorithm). If a delay algorithm is selected, organizations may employ different algorithms for different system components based on the capabilities of the respective components. Responses to unsuccessful logon attempts may be implemented at the operating system and application levels.

Actionable Items: Windows Active Directory Group Policy Editor is a great start for system-wide password policies. Devices such are routers, firewalls, printers and other devices that are not under the control of Active Directory.

Monitoring: There is software that can monitor this as well as event logs in Active Directory. Windows does not notify you if these occurrences take place so it is better to have third part monitoring for a more secure environment.