controls:
    -   id: SRG-OS-000720-GPOS-00170
        title: '{{{ full_name }}} must for password-based authentication, require immediate
                selection of a new password upon account recovery.'
        levels:
            - medium
        fixtext: |-
            This requirement is a permanent finding and cannot be fixed.
            An appropriate mitigation for the system must be implemented, but this finding cannot be considered fixed.
        mitigation: |-
            Ensure system level controls are in place to restrict access to resources upon account reset.

            Although the listed mitigation is supporting the security function, it is not sufficient to reduce the residual risk of this requirement.
        status_justification: |-
            {{{ full_name }}} does not natively support a method of immediately requiring a password reset should an account be reset during an active user session.

            Processes for resetting user passwords should include produces to set the password expiry in the past so that users are prompted to change their password on next logon.
        status: does not meet
