Control A.8.5Secure authentication
What it means in practice
Secure authentication technologies and procedures must be implemented based on information access restrictions and the topic-specific policy on access control.
The control is technology-neutral and risk-driven: the strength of authentication follows from what is being protected, which is decided by A.8.3’s restrictions and A.5.12’s classification.
In practice the direction of travel is away from passwords alone and towards multi-factor and phishing-resistant methods, and the assessment that matters is which factors resist the attacks the organisation actually faces. Second factors that can be relayed or prompted repeatedly resist an automated attack and not a determined one.
Procedures are part of the control, not just technology: what happens on failed attempts, how sessions are handled, how re-authentication is required for sensitive actions, and — the part attackers aim at — how an account is recovered. A strong authentication mechanism with a weak recovery path has the strength of the recovery path.
How to put this in place
Weak or single-factor sign-in is the usual way accounts are taken over. Your ISMS needs authentication strong enough for the sensitivity of each system, applied consistently, with exceptions known and approved.
- List the systems that hold confidential information or give administrative reach, including cloud consoles and remote access.
- Decide the sign-in standard for each tier, for example single sign-on with multi-factor authentication, and stronger methods for administrators.
- Set password rules that favour length, block commonly used and previously breached passwords, and avoid forced regular changes.
- Enforce the standard in the identity system and switch off legacy sign-in methods that bypass it.
- Set limits on failed attempts and lockout handling, and alert on repeated failures.
- Record each exception with an owner and an end date, and review them.
Evidence an auditor usually looks for: identity provider settings including password and lockout rules, the list of systems behind single sign-on and multi-factor authentication, and approved exceptions.
What is in the packs for this
Each one helps with this requirement.
- Excel
Annex A Control Implementation Library
in ISO 27001 Implementation & Certification ReadinessIts row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies. - Excel
Statement of Applicability Template
in ISO 27001 Implementation & Certification ReadinessHas its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented. - Word
Stage 1 and Stage 2 Audit Preparation Guide
in ISO 27001 Implementation & Certification ReadinessListed among the commonly sampled controls, with what an auditor is likely to sample and the likely challenge. - Word
Privileged Access Standard
in Privileged Access ManagementIts Framework References list this control. Supported by: Phishing-resistant sign-in (PA-05). - Excel
Immutable & Offline Backup Protection Checklist
in Backup & Restore AssuranceIts Framework References list this control. Supported by: BP-03: multi-factor authentication on the backup consoles.