What should be done when a user forgets their password and requests a reset?

The most critical first step in any password reset procedure is to positively verify the identity of the user making the request. This prevents unauthorized individuals from gaining access to an account through social engineering. Once identity is confirmed, the request must be handled according to the organization's established and documented password reset process. This ensures that all resets are performed consistently, securely, and in a manner that is auditable and compliant with the organization's security policy.

B. Resetting a password without identity verification is a severe security risk that exposes the account to immediate compromise by an impersonator.

C. Escalating to a supervisor is not a standard initial step; it introduces unnecessary delays for a common IT request and may not be part of the defined process.

D. Prohibiting password resets is an impractical policy that would lock legitimate users out of their accounts, severely impacting productivity and business operations.

1. NIST Special Publication 800-63B, Digital Identity Guidelines: Authentication and Lifecycle Management. Section 5.1.1.2, "Memorized Secret Verifiers", states: "If the claimant has forgotten their memorized secret, the CSP [Credential Service Provider] SHALL... Re-establish the claimant’s identity using a process that is at least as strong as the identity proofing process used to establish the authenticator." This mandates identity verification before a reset.

2. Cisco, Identity and Access Management Design Guide. The guide emphasizes the principle of "strong authentication" as a cornerstone of access control. The process of verifying a user before a password reset is a direct application of this principle, ensuring that only the legitimate user can regain access. (See Chapter: "Identity and Access Control," Section: "Authentication").

3. Carnegie Mellon University, Information Security Office, Guidelines for Password Management. In the section on password resets, it is stipulated that support staff must "verify the identity of the user" through established procedures before assisting with a password reset, illustrating a real-world implementation of this best practice. (See Section: "Password Resets").