5.17 Authentication information
A management process is to control how authentication information is allocated and managed, and it includes telling personnel how to handle such information properly. Purpose: make entity authentication work correctly and prevent authentication processes from failing. Guidance on allocation: temporary passwords or PINs generated at enrolment are unguessable, unique per person and must be changed after first use; a user's identity is verified before new, replacement or temporary authentication information is issued; authentication information is delivered securely over an authenticated, protected channel and never in clear text email; users confirm receipt; vendor default credentials are changed immediately after installation; and significant allocation and management events are recorded confidentially using an approved method such as a password vault. User responsibilities: keep secret authentication information confidential and never share personal secrets, with secrets for shared or non-personal identities disclosed only to authorized people; change credentials at once when compromise is notified or suspected; choose strong passwords that are not guessable from personal details, not dictionary words, use memorable passphrases with mixed characters and meet a minimum length; do not reuse passwords across services; and have these duties written into employment terms (6.2). A password management system should let users choose and change passwords with a confirmation step, enforce strength, force change at first login, force change when needed (after an incident, or when someone who knew a shared password leaves or changes job), block reuse, reject common passwords and credentials known from breaches, hide passwords as typed, and store and transmit them protected, with hashing and encryption per approved cryptography (8.24). Other information: keys, smart card tokens and biometrics are other forms of authentication information (see ISO/IEC 24760); forcing frequent password changes can backfire; SSO and password vaults reduce what users must protect but raise the impact of a disclosure; where an independent authority assigns passwords, the user-selection, first-login and forced-change items do not apply.
Source: ISO/IEC 27002:2022, 5.17. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO/IEC 27002:2022 in the compliance library.
ISO/IEC 27002 is guidance on the Annex A controls; certification is against ISO/IEC 27001. Use this set when your sheet follows the 27002 numbering.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
- Password policy and technical configuration showing length, complexity, reuse prevention, breached-password blocking and masked entry · Identity provider / directory
periodic reviewEvidence produced at each review
- Evidence that initial credentials are unique, delivered over protected channels and changed at first use · Identity provider / directory
- Records of vendor default credentials being changed at installation · Identity provider / directory
- An approved password vault or secret store holding records of credential allocation, with evidence that passwords are stored hashed using approved techniques · Identity provider / directory
governing documentDocuments that govern the control
- Credential issuance procedure requiring identity verification before new, replacement or temporary credentials are provided · Policy repository / GRC workspace
- Employment terms containing the user duties for authentication information · Policy repository / GRC workspace
First move
Common gaps auditors find
- Initial passwords are sent in clear text email or use a predictable pattern
- Default vendor credentials remain on network devices or appliances
- Shared account passwords are not changed when someone who knew them leaves
- No check against known breached passwords is performed
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet