Authentication information

What the requirement asks

A management process is to control how authentication information is allocated and managed, and it includes telling personnel how to handle such information properly. Purpose: make entity authentication work correctly and prevent authentication processes from failing. Guidance on allocation: temporary passwords or PINs generated at enrolment are unguessable, unique per person and must be changed after first use; a user's identity is verified before new, replacement or temporary authentication information is issued; authentication information is delivered securely over an authenticated, protected channel and never in clear text email; users confirm receipt; vendor default credentials are changed immediately after installation; and significant allocation and management events are recorded confidentially using an approved method such as a password vault. User responsibilities: keep secret authentication information confidential and never share personal secrets, with secrets for shared or non-personal identities disclosed only to authorized people; change credentials at once when compromise is notified or suspected; choose strong passwords that are not guessable from personal details, not dictionary words, use memorable passphrases with mixed characters and meet a minimum length; do not reuse passwords across services; and have these duties written into employment terms (6.2). A password management system should let users choose and change passwords with a confirmation step, enforce strength, force change at first login, force change when needed (after an incident, or when someone who knew a shared password leaves or changes job), block reuse, reject common passwords and credentials known from breaches, hide passwords as typed, and store and transmit them protected, with hashing and encryption per approved cryptography (8.24). Other information: keys, smart card tokens and biometrics are other forms of authentication information (see ISO/IEC 24760); forcing frequent password changes can backfire; SSO and password vaults reduce what users must protect but raise the impact of a disclosure; where an independent authority assigns passwords, the user-selection, first-login and forced-change items do not apply. In the ISMS the control is compared with the controls determined in risk treatment and recorded in the Statement of Applicability as included or excluded, with the reason and the implementation status.

What the guidance adds

Authentication information is expected to be issued, protected, rotated and revoked. The guidance asks for the method, the storage, the reset route and the evidence that shared credentials are not in use.

What good looks like

Put the control in the Statement of Applicability with an owner, a status and the risk it treats. Then keep credential issuance procedure requiring identity verification before new, replacement or temporary credentials are provided and one live sample together.

Evidence an assessor asks for

• Credential issuanceCredential issuance procedure requiring identity verification before new, replacement or temporary credentials are provided
• Credential issuanceEvidence that initial credentials are unique, delivered over protected channels and changed at first use
• Credential issuancePassword policy and technical configuration showing length, complexity, reuse prevention, breached-password blocking and masked entry
• Credential issuanceRecords of vendor default credentials being changed at installation
• Credential issuanceEmployment terms containing the user duties for authentication information
• Credential issuanceAn approved password vault or secret store holding records of credential allocation, with evidence that passwords are stored hashed using approved techniques

The question an assessor will ask

An assessor will ask for credential issuance procedure requiring identity verification before new, replacement or temporary credentials are provided, then trace it to the system it protects. For A.5.17 the test is whether that record ties to a live sample, not whether the control is named in a policy.

Common gaps

• Initial passwords are sent in clear text email or use a predictable pattern
• Default vendor credentials remain on network devices or appliances
• Shared account passwords are not changed when someone who knew them leaves
• No check against known breached passwords is performed

Before the next audit

Before the next audit, check one live sample for this gap: initial passwords are sent in clear text email or use a predictable pattern.