Control A.5.17Authentication information
Allocation and management of authentication information must be controlled by a management process, including advising personnel on the appropriate handling of authentication information.
Authentication information is broader than passwords: it includes tokens, certificates, keys and the recovery mechanisms behind them, which are frequently weaker than the credential they protect.
The control covers allocation — how a credential first reaches its holder, which is the moment it is most exposed — and management thereafter: storage, change, revocation, and the treatment of default credentials, which remain among the most reliable ways into an estate.
The advice element is explicit and is not satisfied by a password policy. People need to know what to do when a credential may have been exposed, and the organisation needs them to say so quickly — which means the response to a reported exposure must not be punitive, or it will be the last one reported.
Modern practice has moved towards phishing-resistant factors; the control is technology-neutral and the risk assessment decides.
How to put this in place
Stolen or guessed credentials are a common way in. The ISMS needs a consistent way to issue, protect and replace them.
- Decide the rules in line with current guidance, favouring length over complexity, avoiding routine forced changes and checking against breached lists.
- Check who is asking before issuing or resetting credentials, send initial ones securely and require a change at first use.
- Provide a password manager and consider multi-factor authentication, starting with administrators, remote access and cloud services.
- Replace vendor default passwords on devices.
- Tell users how to report a credential they think is exposed.
Evidence an auditor usually looks for: password and authentication settings in the directory, the password manager deployment, and the user guidance on credentials.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.