Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

Control A.5.17Authentication information

What it means in practice

Allocation and management of authentication information must be controlled by a management process, including advising personnel on the appropriate handling of authentication information.

Authentication information is broader than passwords: it includes tokens, certificates, keys and the recovery mechanisms behind them, which are frequently weaker than the credential they protect.

The control covers allocation — how a credential first reaches its holder, which is the moment it is most exposed — and management thereafter: storage, change, revocation, and the treatment of default credentials, which remain among the most reliable ways into an estate.

The advice element is explicit and is not satisfied by a password policy. People need to know what to do when a credential may have been exposed, and the organisation needs them to say so quickly — which means the response to a reported exposure must not be punitive, or it will be the last one reported.

Modern practice has moved towards phishing-resistant factors; the control is technology-neutral and the risk assessment decides.

How to put this in place

Stolen or guessed credentials are a common way in. The ISMS needs a consistent way to issue, protect and replace them.

  1. Decide the rules in line with current guidance, favouring length over complexity, avoiding routine forced changes and checking against breached lists.
  2. Check who is asking before issuing or resetting credentials, send initial ones securely and require a change at first use.
  3. Provide a password manager and consider multi-factor authentication, starting with administrators, remote access and cloud services.
  4. Replace vendor default passwords on devices.
  5. Tell users how to report a credential they think is exposed.

Evidence an auditor usually looks for: password and authentication settings in the directory, the password manager deployment, and the user guidance on credentials.

What is in the packs for this

Each one helps with this requirement.

  • Excel

    Annex A Control Implementation Library

    in ISO 27001 Implementation & Certification ReadinessIts row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
  • Excel

    Statement of Applicability Template

    in ISO 27001 Implementation & Certification ReadinessHas its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.
  • Word

    Access Control Policy

    in Joiner-Mover-Leaver & Access ProvisioningIts Framework References list this control. Supported by: First sign-in given only to the joiner; resets after an identity check (JML-07, JML-13).
  • Word

    Joiner-Mover-Leaver Operating Procedure

    in Joiner-Mover-Leaver & Access ProvisioningIts Framework References list this control. Supported by: First sign-in for joiners; password and factor resets.
  • Word

    Privileged Access Standard

    in Privileged Access ManagementIts Framework References list this control. Supported by: Credential rotation; resets (PA-10, PA-17).
  • Word

    Privileged Access Request, Elevation & Revocation Procedure

    in Privileged Access ManagementIts Framework References list this control. Supported by: Resetting privileged credentials.
  • Excel

    Privileged & Service Account Inventory

    in Privileged Access ManagementIts Framework References list this control. Supported by: Inventory: where each shared, service and break-glass credential is kept, and when it was last changed.