AC-7 requires the organization to enforce a limit on consecutive unsuccessful logon attempts to an information system and take an organization-defined action (such as locking the account for a defined period or delaying the next logon) when that limit is exceeded. The control slows automated password guessing and credential stuffing without becoming a denial-of-service weapon against legitimate clinicians.
Reduce the chance that attackers guess or spray passwords against systems that store or process ePHI, while keeping lockout thresholds practical for busy clinical and revenue-cycle workflows.
Define policy values before you configure tools:
How this control shows up in healthcare and HIPAA-covered environments.
A 12-provider clinic sees hundreds of failed EHR logons overnight from foreign IPs. With AC-7 enforced at the identity provider (5 failures → 30-minute lock), automated sprays stall, and the SOC uses the lockout surge as an early warning to force password resets and enable MFA for remote roles.
A third-party billing company accesses your practice management cloud. Without account lockout, a compromised contractor password can be guessed offline forever. AC-7 on the vendor IdP, plus unique vendor accounts (not shared logins), contains the blast radius and produces audit evidence for BA oversight.
Domain admin attempts against a bastion host use a stricter threshold (3 failures → permanent lock requiring dual approval to unlock). Clinical user thresholds stay higher so nurses are not constantly locked out during shift change.
Auditors look for written thresholds, technical enforcement evidence (not just policy text), consistent application across systems holding ePHI, and proof that unlocks are controlled. Be ready to show sample lockout tickets and that clinical emergency access was considered.
How this NIST control supports HIPAA Security Rule expectations.
Use moderate thresholds and temporary locks for clinical roles, reserve hard locks for admins, and document a verified unlock path so care is not blocked.
No. AC-7 slows guessing; MFA stops most stolen-password logons. Use both for remote and privileged access to ePHI.
AC-2 covers the account lifecycle (create, modify, disable). AC-7 is the runtime defense that reacts when logon attempts fail repeatedly.
Related controls that commonly accompany AC-7.
Our auditors map NIST SP 800-53 controls to your HIPAA Security Rule program — policies, technical evidence, and audit readiness.
