Key takeaways
- Control how passwords, keys and other secrets are issued and protected.
- Passwords, keys and tokens are the keys to the kingdom.
- Start here: set authentication rules: length-based passwords, MFA, no reuse.
Purpose
Control how passwords, keys and other secrets are issued and protected.
Requirement
Requirement summaryAllocation and management of authentication information shall be controlled by a management process, including advising personnel on the appropriate handling of authentication information.
Why it matters
Passwords, keys and tokens are the keys to the kingdom. Weak handling is behind a large share of breaches.
How to implement
- Set authentication rules: length-based passwords, MFA, no reuse.
- Issue initial credentials securely and force change on first use.
- Provide a password manager and train staff to use it.
- Store system secrets in a vault, not in code or spreadsheets.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 5.17. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your password and login policy, including multi-factor authentication (a second step like a code or app approval).
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.5.17 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Screenshots or exports of system settings showing password and multi-factor rules are switched on.
- Proof that new users must change their first password.
- Staff acknowledgement that they must keep passwords secret.
Things you should be able to show or explain
- Be able to show multi-factor login on your most important systems.
How much to show: Your three to five most important systems.
Common mistakes
- Multi-factor not required for remote or admin access.
- Passwords shared in chats or spreadsheets.
- Secrets hard-coded in source code.
- MFA enforced for some systems but not email or admin consoles.
- Tip: Mandate a password manager and MFA.
Policies & documents to have
- Access Control Policy
- Information Security Policy
FAQ
Is A.5.17 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.5.17?
Be ready to explain how the control works in your organisation and to provide things like: Your password and login policy, including multi-factor authentication (a second step like a code or app approval)…