PSS-07 Confidentiality of Authentication Information
Where passwords authenticate to the service, users set their own or must replace an initial password expiring within fourteen days, length and complexity rules are technically enforced, users are notified of changes or r
4
artefacts
1
held by a system
0
at each review
moderate
to go live
Identity provider / directory
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Configuration showing initial password validity capped at fourteen days · Identity provider / directory
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- Technical enforcement settings for password length and complexity · Policy repository / GRC workspace
- Copy of the message sent to a user on password change or reset · Policy repository / GRC workspace
- Documentation of the hash function and salt length used for server side storage · Policy repository / GRC workspace
First move
Start with the 1 of 4 artefacts that already live in a system (Identity provider / directory); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Initial passwords stay valid indefinitely until the account is first used
- Complexity rules stated in guidance but not enforced by the system
- Hashes stored with an outdated function or without a unique salt per password
- Users not informed when a reset is performed on their account by an administrator
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet