NIST 800-171 Controls · Identification & Authentication
IA.2.086 — Obscure feedback of authentication information
Obscure feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals.
What IA.2.086 means in plain English
When someone types a password, the characters must appear as dots or asterisks — not as the actual letters and numbers. This prevents "shoulder surfing," where someone nearby reads your password as you type it. It also applies to any error messages: a failed login should say "Invalid username or password" not "Invalid password" (which confirms the username is correct). This is a default behavior in every modern operating system and browser, but you must verify it has not been disabled anywhere and that no custom application you use shows password characters in clear text.
The assessment question
“Are all password entry fields on all systems configured to mask input characters — and do authentication failure messages avoid disclosing whether the username or password was the failing element?”
How to implement IA.2.086
- Test every login screen used by your employees (Windows logon, Microsoft 365, VPN portal, line-of-business apps) and confirm password characters display as dots or asterisks.
- If any custom or third-party application shows password characters in plain text, contact the vendor for a fix or configuration change; document it as a Plan of Action & Milestones (POA&M) item if no fix is available.
- Review authentication error messages across all systems: they should say "invalid credentials" rather than specifically identifying which field failed.
- Disable the "Show password" reveal button on any kiosk or shared workstation login screens through Group Policy if your environment warrants it.
- Add a "shoulder surfing awareness" note to your annual security awareness training.
Evidence your assessor will ask for
- Screenshots of each major login screen showing masked password fields
- Documentation of any exceptions identified and POA&M entries created
- Review of authentication error messages confirming generic wording
- Security awareness training materials including shoulder surfing guidance
Does AI prompt monitoring help with this control? Honestly, no.
IA.2.086 is met through the remediation steps above, not through AI traffic controls — an AI prompt firewall neither satisfies nor substitutes for it. We map AI monitoring only to the controls it genuinely evidences (flow control, boundary protection, audit, and incident support); for the full picture of where it does help, see the mapping guide linked below.
Full mapping: which 800-171 controls AI prompt monitoring evidences →
More Identification & Authentication controls
Identify system users, processes, and devices
IA.1.077Authenticate identities of users, processes, and devices
IA.2.078Use multifactor authentication for local and network access
IA.2.079Employ replay-resistant authentication mechanisms
IA.2.080Prevent reuse of identifiers
IA.2.081Disable identifiers after defined period of inactivity
Score yourself against all 110 controls
The free ShieldReady assessment walks every NIST 800-171 requirement, computes your SPRS score, and shows exactly which gaps cost the most points.