NIST SP 800-171 password management with a self-hosted vault

How a self-hosted vault supports NIST SP 800-171 password management

A self-hosted vault supports requirement 03.05.07 in part, and the rest of the requirement has to be enforced at the system level. Requirement 03.05.07 in *NIST SP 800-171 Rev. 3* asks the organization to keep a list of commonly used, expected or compromised passwords and check new passwords against it, to transmit and store passwords in cryptographically protected form, to force a new password on first use after account recovery, and to enforce composition and complexity rules. A vault covers the storage, sharing and recovery parts well, but the blocklist check, the update cadence and the password rules usually live in the directory, the identity provider or the operating system. Before you size a vault for a contractor, map each sub-element to the system that actually enforces it and write that mapping into the system security plan.

Revision matters before you pick settings. Rev. 2 still governs CMMC Level 2 under 32 CFR 170.14(c)(3), and the DoW class deviation signed on 3 September 2026 points contracting officers to Rev. 2 while CMMC Phase 2 is suspended, so most contracts you hold today are assessed against the 110 Rev. 2 requirements. The FAR overhaul proposed rule of 23 June 2026 would move contractors to Rev. 3, but it was not final as of October 2026. Confirm with your contracting officer which revision your contract names, and treat Rev. 3 as the direction of travel.

Rev. 3 also introduces organization-defined parameters (ODPs). For 03.05.07, two ODPs need values: how often the compromised password list is updated, and the composition and complexity rules. NIST does not assign these values, and if your federal customer does not specify them, you must assign them yourself to complete the requirement. Document both values, the reason you chose them, and the approver, because an assessor will check that they are defined before testing the control. Also confirm the exact revision and ODP expectations in your contract, since the proposed rule would supply DoW-published values.

Mapping 03.05.07 requirements to vault configuration

This table maps each part of requirement 03.05.07 to what the function must do, how to configure it in Passbolt or Vaultwarden, and what the platform cannot satisfy alone. Use it as a working checklist, with the two organization-defined parameters and the assessor's determination statements as the anchors for your evidence. The main takeaway is that the vault covers storage and sharing, while the list maintenance, composition rules and recovery enforcement often sit with the identity layer or your own procedures.

Requirement part	What the function must do	How to configure in Passbolt or Vaultwarden	What the platform does not do alone
Compromised password list and checks	Keep and regularly update a list of commonly used, expected or compromised passwords, and check new passwords against it	Vaultwarden and Passbolt do not ship a maintained breached-password list you can rely on for this purpose; confirm any built-in check with the vendor before claiming coverage	Sourcing, updating and distributing the list, and enforcing the check at the identity provider or directory where users set passwords
ODP: list update frequency	Organization must define how often the list is updated	Record the frequency in your password standard and tie it to a named owner and change log	The platform does not set the frequency; the organization or the DoW value, if published, must supply it
Cryptographically protected transmission	Passwords move only over cryptographically protected channels	Serve the vault only over HTTPS with a valid certificate; Vaultwarden requires HTTPS for the web vault; keep TLS on the reverse proxy and database connections	TLS configuration of endpoints, proxies and backups is your responsibility and must be verified by scan or review
Cryptographically protected storage	Stored passwords are held in cryptographically protected form	Passbolt encrypts client-side with OpenPGP so the server stores ciphertext; for Vaultwarden, confirm the vault encryption model and protect the database and attachments at rest	Protecting database files, backups, server disks and key material outside the vault is not covered by the application alone
New password after account recovery	Require a new password on first use after recovery	Passbolt account recovery is a Pro feature; for Vaultwarden, set policy and procedure for recovered accounts and test the flow	Forcing a password change at login depends on the identity layer or documented process; the vault may not enforce it in every recovery path
ODP: composition and complexity rules	Organization defines and enforces composition and complexity rules for passwords	Passbolt passphrase and password policies are a Pro feature; in Vaultwarden, configure password generator and policy settings where available and confirm the enforced rules	The vault does not define your rules; rules for passwords outside the vault and for system accounts must be set elsewhere
Assessor checklist	SP 800-171A Rev. 3 uses eight determination statements plus two that check the ODP values are defined, assessed by examine, interview and test	Map each statement to a screenshot, configuration export, policy document, interview note or test record	Assessment outcomes come from the assessor; DeployOpen prepares evidence but does not issue assessment results

Which vault fits a CUI environment: Passbolt, Vaultwarden or self-hosted Bitwarden

Passbolt is the candidate with the most documented controls for a team vault in a regulated setting. Its API server is licensed under AGPL-3.0, and it uses end-to-end encryption based on OpenPGP: each user holds a key pair, and each user with access to a shared resource gets their own encrypted copy. Passbolt's documentation states that the server only receives and stores ciphertext. The Community Edition is free and self-hosted, while several controls that matter for an assessment sit in the Pro edition.

Encryption model: Encryption and decryption happen in the browser extension or mobile app, not on the server, and the browser extension is cryptographically signed.
Pro-only controls: Pro adds account recovery, MFA policies, passphrase and password policies, a password expiry policy, and syslog activity logs. The Community Edition does not list these.
Directory and SSO: LDAP user and group provisioning from AD or OpenLDAP, SSO with Microsoft, Google, OpenID and AD FS, and SCIM are listed as Pro features.
Export controls: Since Passbolt 5.10, cleartext CSV export is disabled by default, and administrators must allow it again in export policies.
Release cadence: Passbolt v5.16.0 was published on September 17, 2026, after v5.15.0 and v5.14.0.

Confirm with Passbolt which edition covers each control in your assessment, how account recovery works when a user loses a key, and whether Pro licensing and support terms fit your procurement rules.

Selection criteria for a contractor's password vault

A password vault that holds credentials for systems storing or transmitting CUI becomes part of the assessed environment. The six criteria below focus on where encryption happens, what evidence the vault produces, how it joins your identity provider, and what you must support yourself.

Encryption model and server visibility

Ask whether credentials are encrypted on the client before they reach the server, and who holds the keys. Passbolt uses OpenPGP end-to-end encryption, with each user holding a key pair and each shared resource encrypted per recipient, so the server stores ciphertext only. Confirm which metadata, such as resource names and URLs, stays encrypted under your configuration, because that metadata may still describe CUI systems.

Activity logs as assessment evidence

Under SP 800-171 you must show how credentials are managed, which means showing who accessed or changed a shared secret and when. Syslog activity logs are a paid Passbolt Pro feature, so confirm before purchase that the community edition meets your evidence needs. Forward logs to your central SIEM and test that retention covers your assessment window.

SSO and MFA with your identity provider

Vault logins should follow the same authentication rules as the rest of your CUI environment, including multi-factor authentication. Passbolt lists SSO with Microsoft, Google, OpenID and AD FS, plus MFA policies and LDAP provisioning, as Pro features. Vaultwarden added OpenID Connect single sign-on in version 1.35.0 and supports FIDO2 WebAuthn for two-factor login. Verify that the chosen method enforces MFA for every user, including administrators.

Account recovery without weakening control

Recovery design determines whether a lost key or a departed administrator leaves credentials stranded or exposed. Under 03.05.07, a new password is required on first use after account recovery, so the process must reset the credential rather than just restore access. Document who can approve recovery, how it is logged, and whether a second person must confirm it. Passbolt lists account recovery as a Pro feature.

Editions and paid features

Map each control you need to the edition that provides it before you commit to a design. Passbolt's Community Edition is free and self-hosted with unlimited users, while Pro adds LDAP provisioning, password expiry policy, passphrase and password policies, and SCIM. Policy features such as composition rules, which 03.05.07 requires you to define, may sit in a paid tier. Get the feature comparison in writing from the vendor.

Support and patching obligations

Self-hosting moves patching, backups and incident response to your team or your partner. Vaultwarden's maintainers state that they cannot be held liable for data loss and recommend regular backups of files and the database, and they ask users to report bugs to the Vaultwarden project rather than to Bitwarden. Define in writing who applies releases, who restores from backup, and who responds when a vulnerability is disclosed, and confirm the support terms for your chosen edition.

Evidence assessors ask for and which component produces it

This table maps the records an assessor typically asks for under 03.05.07 to the component that produces each one and the owner who must keep it current. Assessors examine these records, but they also interview staff and test the vault and identity settings directly, so a record alone rarely closes a determination.

Evidence item	Produced by	Owned by
Written password policy and ODP values for composition and list update frequency	Organization documents (policy, standard and the recorded ODP values)	Information security or compliance lead
Update records for the commonly used, expected or compromised password list	Organization records, checked against vault password policy settings	Security operations, with the list update cadence set in policy
Vault configuration export showing password policy, passphrase rules and expiry settings	Vault (Passbolt Pro policy settings or Vaultwarden policy configuration), captured as a dated export	Vault administrator
Evidence that new passwords are checked against the banned list	Vault policy configuration and test results, with a supporting description of any external check	Vault administrator and the team that runs the vault
Activity and admin logs for password changes, sharing and resets	Vault audit logs, forwarded to the SIEM for retention and review	Vault administrator for the logs, SIEM team for retention and review
User and group provisioning records for vault access	Identity provider (directory sync or SCIM feeds into the vault) plus approval tickets	Identity team, with joiner and leaver approvals owned by the business owner
Recovery procedure test records, including forced password change on first use after recovery	Vault recovery logs and a signed test record from the administrator	Vault administrator and the security lead who witnesses the test
Backup and restore test records for the vault database and attachments	Backup tooling and restore test output from the hosting team	Platform or infrastructure team
SSO and MFA configuration for vault sign-in	Identity provider configuration export and MFA policy records	Identity team, reviewed by the security lead

What the password manager alone does not satisfy

A self-hosted vault covers how passwords are stored, shared and recovered, but SP 800-171 requirements also reach logins that never touch the vault, the directories behind them, and the version of the standard your contract names. The cards below list the gaps to close at the system level and what to confirm for each before you assess your environment.

Banned-password list maintenance

Requirement 03.05.07 expects a list of commonly used, expected or compromised passwords, refreshed on an organization-defined schedule, and new passwords checked against it. Vaultwarden and Passbolt do not, as far as the supplied material shows, provide this check for accounts created in the directory or in SaaS applications. Confirm whether the vault's password generator and policy engine can reject listed passwords, who maintains the list, and how often it is refreshed.

Directory and OS password policy

Most logins to workstations, servers and business applications authenticate against Active Directory, OpenLDAP, Linux PAM or an identity provider, not the vault. Their composition, history and lockout settings must meet the same organization-defined rules you set for 03.05.07, and those rules must be enforced where the password is set. Confirm which directory holds each credential class and that its policy object matches the rules documented in your System Security Plan.

MFA for network and system access

A vault that offers two-factor login protects only the vault itself. Remote access, VPN, administrative consoles and cloud tenants need multifactor authentication enforced by the identity layer, and a shared password stored in a vault does not replace it. Confirm which systems in your CUI boundary require MFA, which factor types are allowed, and whether the identity provider enforces the policy for every path to CUI.

Composition rules outside the vault

Passbolt's Pro edition lists passphrase and password policies, and Vaultwarden supports organization policies, but those settings apply to credentials stored in the vault. Composition and complexity rules for accounts created elsewhere depend on the application or directory. Confirm which systems accept your ODP values, record any system that cannot enforce them, and document a compensating control for each one.

Service and privileged account handling

Service accounts, API keys and administrator accounts often have no interactive user, so their passwords are rotated by scripts or never. A password manager stores them in cryptographically protected form, but it does not by itself enforce rotation, restrict who can retrieve them or record each use at the target system. Confirm who may retrieve each privileged credential, how use is logged on the target, and whether a secrets manager or privileged access tool is needed for machine credentials.

Rev. 2 or Rev. 3 and DFARS version

The version your contract names decides which requirement set you assess. Rev. 2 has 110 requirements and remains the basis for CMMC Level 2, while Rev. 3 has 97 requirements and organization-defined parameters that must be assigned. Confirm in writing which revision your contracting officer and DFARS clause reference, whether the FAR overhaul rule has become final, and which ODP values the buyer has published, before mapping the vault to any numbered requirement.

How the vault gets assessed and rolled out for CUI

This sequence scopes the CUI environment first, then fixes the password rules and edition choice, and only then builds and tests the vault. It produces a vault whose configuration, access records and recovery tests can be shown to an assessor.

Confirm the CUI boundary and assessment scope
The contractor, with DeployOpen as a facilitator, identifies every system, user group and shared account that will store, process or transmit CUI, and decides whether the vault itself falls inside that boundary. Storing CUI-related credentials in the vault can bring the vault and its hosts into scope, so this decision comes before any product selection. The step closes with a written scope statement that names the vault, its hosts, databases, backups, identity provider and administrators, and that the contracting officer or assessment sponsor has been asked to confirm which SP 800-171 revision applies to the contract.
Assign organization-defined parameter values
The contractor sets the values for the two ODPs attached to 03.05.07: how often the list of commonly used, expected or compromised passwords is updated, and the composition and complexity rules. Unless a federal agency has specified these values, the nonfederal organization must assign them to complete the requirement. The client supplies the policy owner and approver, and the output is a signed password standard that the vault's policy settings will be checked against. Confirm with the contracting officer whether DoW-published ODP values apply under any pending rule before finalizing.
Select the edition against required features
Map the ODP-driven policy and the access model to the feature set of each candidate: Vaultwarden, Passbolt Community or Pro, and self-hosted Bitwarden. Passbolt lists LDAP provisioning, account recovery, SSO, MFA policies, syslog activity logs, password policies, password expiry and SCIM as Pro features, so the edition decision depends on which of these the assessment plan needs. Ask the vendor or partner to confirm in writing whether each required capability exists in the chosen edition and version, and record the licensing cost, which recurs per user for paid tiers. The output is a feature traceability table tied to the requirement.
Deploy on contractor-controlled infrastructure with HTTPS
DeployOpen builds the vault on servers or cloud accounts the contractor controls, using a documented install path, with the database, file store and backups on the same controlled boundary. HTTPS is configured end to end with a reverse proxy, because the web vault depends on the Web Crypto API. Administrative access, host hardening and logging are set up as part of the build, and the vault's own admin interface is restricted to named administrators. The output is an as-built diagram, configuration files under version control, and a host inventory that matches the scope statement from the first step.
Integrate SSO and MFA with the identity provider
The vault is connected to the organization's identity provider so that users authenticate once, with multi-factor authentication enforced for every login path. The team confirms which factors the vault accepts and which fallback path exists, including whether a local login remains for break-glass use. Directory group membership is mapped to vault roles so that access is granted and removed through the directory. The output is a tested login matrix that shows each user type, factor and result, and a list of the admin paths that bypass SSO, each with a documented justification.
Import and retire existing credential stores
Credentials move from spreadsheets, browser stores and older managers into the vault using the import formats the chosen edition supports, after which the old stores are removed or locked down. Plaintext exports are disabled by default in recent Passbolt versions, and the team should confirm the same export policy for any other edition. The client supplies the inventory of existing stores and an owner for each shared account. The output is an import log, a reconciliation count of imported and retired records, and written confirmation that no cleartext copies remain in known locations.
Test recovery, restore and password rules
The team tests the controls that the assessor will examine: that new passwords are checked against the compromised-password list, that the required composition rules are enforced, that a new password is required on first use after account recovery, and that a backup restores into a clean environment with working logins. Results are recorded against the requirement, and any gap found becomes a tracked change before sign-off. Recovery tests are run by named staff, and the output is a dated test report with pass, fail and remediation entries for each check.
Collect evidence for the assessment
DeployOpen assembles the evidence package that the contractor's assessor or CMMC assessment team may request: the scope statement, ODP decisions, configuration exports, access reviews, activity log samples, the test report, and the operating procedures for updating the compromised-password list. DeployOpen prepares this material but does not issue any audit result or certification, which remains the role of the independent assessor. The output is an evidence index mapped to 03.05.07 and to related practices in the CMMC scope, plus a list of items that system-level controls, such as network and host configuration, must still supply.

Questions contractors ask before they deploy a vault for CUI

Does a self-hosted password manager satisfy NIST SP 800-171 requirement 03.05.07 on its own?

No. A vault covers part of 03.05.07, mainly the storage and transmission of passwords, sharing and recovery workflows, and some composition settings. The requirement also expects an organization-defined list of commonly used, expected or compromised passwords that is updated on a set frequency and checked against new passwords, and that list lives outside the vault. Account-level rules such as the first-use reset after recovery must be enforced by the identity system or the directory that controls the accounts. Map each sub-part to the tool that enforces it and record the owner. Your assessor will look for that mapping, so expect the vault to be one piece of the evidence rather than the whole answer.

Which SP 800-171 revision applies to my contract?

Your contract and the DFARS clause in it decide this, so confirm with your contracting officer rather than assuming. As of October 2026, DoW Class Deviation 2026-O0025, Revision 3, has contracting officers use a revised DFARS 252.204-7012 that names SP 800-171 Revision 2 explicitly, and it cites a 13 July 2026 DoW CIO memorandum requiring baseline compliance with Rev. 2 while CMMC Phase 2 is suspended. The CMMC Level 2 requirements are identical to Rev. 2's 110 requirements. Rev. 3 contains 97 requirements. Ask your contracting officer which revision and which ODP values apply, and get the answer in writing.

What does Passbolt Pro cost and what drives the total cost?

Passbolt's pricing page lists Pro at $4.9 per user per month, billed annually, with a 10-user minimum and volume discounts after 100 users. The Community Edition is free and self-hosted with unlimited users, but several controls a CUI program often needs, such as LDAP provisioning, account recovery, SSO, MFA policies, syslog activity logs, password policies, a password expiry policy and SCIM, are listed as Pro features. Total cost also includes the server, database and backup infrastructure you run, staff time for patching and upgrades, rollout and training, and any support retainer you buy. Ask for a quote that separates one-time work from recurring license, hosting and support costs, and states which features each edition includes.

How long does a rollout take and what do we need to supply?

Duration depends on the number of users, the directory and SSO design, how much data is imported, and how many systems need to be connected, so no general timeline applies. Expect your side to supply a named sponsor, an inventory of shared accounts, the directory or identity provider configuration, the hosting target and its network rules, certificates for HTTPS, backup storage, and staff for testing and training. Passbolt's install guide lists supported Linux distributions, Docker, a Kubernetes Helm chart and Ansible, so confirm which one matches your platform before scoping. A fixed-scope written plan from the implementation partner should list each deliverable and the dependencies you must provide.

Can our own IT staff run a self-hosted vault after go-live?

Yes, if they have the skills and time to operate it, and many teams do. Operation covers OS and container patching, database backup and restore testing, TLS certificate renewal, log retention, user lifecycle, and upgrades. Vaultwarden, for example, recommends regular backups of files and the database and states its maintainers cannot be held liable for data loss, which means the backup and restore duty sits with you. Passbolt publishes a regular release cadence on GitHub. Decide who owns each task on a written runbook. If the in-house team lacks capacity, DeployOpen can provide ongoing support through a retainer, with scope agreed in writing.

What changes once the FAR overhaul rule is final?

A FAR overhaul proposed rule published on 23 June 2026 would require contractors handling CUI to comply with SP 800-171 Rev. 3 using ODP values published by the DoW CIO. Comments closed on 23 July 2026, and the rule was not final as of October 2026. If it is finalized as proposed, your vault controls would need to be mapped to Rev. 3 numbering, including the ODP values for 03.05.07, such as the frequency for updating the compromised password list and the composition rules. Ask your contracting officer and counsel when the rule is expected to apply and whether Rev. 2 assessments carry forward.

Where does the vault stop and the identity system take over?

The vault stores and shares credentials, but account policy lives in the identity layer. Requirements such as MFA for every user, lockout and session rules, forced reset after recovery, and directory deprovisioning are usually enforced by the identity provider or the directory, not by the vault. Passbolt's Pro features list LDAP provisioning, SSO and MFA policies, and Vaultwarden supports two-factor logins and SSO with OpenID Connect, so check which of these you actually enable. Document the enforcement point for each sub-part of 03.05.07, and test the offboarding path end to end.

How DeployOpen scopes and supports a CUI password vault

DeployOpen plans, implements, hardens, documents and supports self-hosted open-source platforms inside the client's own infrastructure. For a CUI password vault, that means agreeing in writing which parts of SP 800-171 requirement 03.05.07 the vault will support, which parts system-level controls must enforce, and what evidence the assessment will need.

How we scope

Confirm which CUI systems, user groups and shared accounts the vault will cover, in writing before work starts
Agree the organization-defined values for the commonly used password list update frequency and composition rules
Map which determination statements the vault covers and which depend on the directory, SSO or endpoint settings
Record the boundary of the environment, including where the vault server, database and backups sit

How we build

Deploy the chosen vault (Passbolt, Vaultwarden or self-hosted Bitwarden) in your cloud account, data center or air-gapped network
Configure HTTPS, database backups, admin access, sharing groups and password policies to match the agreed parameters
Connect directory or SSO settings where the edition and the agreed scope support them, and test each setting
Document configuration baselines and test results against the assessment methods of SP 800-171A Rev. 3

How we hand over

Deliver written runbooks for onboarding, offboarding, account recovery and password reset after recovery
Provide an evidence pack listing configuration exports, policy settings, test records and the system-level controls still required
Train administrators and vault owners on the procedures they must perform and record
Confirm the handover in writing, with ownership of the server, backups and upgrades assigned to named staff

How we support

Offer ongoing support, upgrades and continuous testing as a retainer, scoped separately from the build
Re-test password policy settings after each vault upgrade and record the results for the assessment file
Review the evidence pack when the assessing body, the DFARS clause or the SP 800-171 revision changes
Confirm with your contracting officer and assessor which SP 800-171 revision and ODP values apply to your contract

Self-hosted password manager for NIST SP 800-171 password management