ISO 27001 A.5.17 - Authentication Information

Requirement

“Allocation and management of authentication information shall be controlled by a management process, including advising personnel on appropriate handling of authentication information.”

Plain-language meaning

The organization must control how secret authentication information is issued, changed, protected, reset, and handled.

Authentication information includes passwords, PINs, passphrases, recovery answers, biometric templates or biometric data where used, temporary passwords, default credentials, tokens or secrets, and other information used to prove identity. User IDs and email addresses are identifiers, not secret authentication information.

Why this matters

Weak credential handling leads directly to unauthorized access. A strong access control model still fails if passwords are guessed, shared, written on notes, reset insecurely, or left as vendor defaults.

Authentication information connects tightly to A.5.15 Access Control and A.5.16 Identity Management. Identity says who the user is. Access control says what they can access. Authentication information helps prove the user is really the claimed identity.

Implementation guidance

1. Define a management process

The organization should document how authentication information is:

• issued;
• delivered;
• acknowledged;
• changed on first use;
• reset;
• stored;
• protected;
• revoked;
• reviewed where relevant.

The process should apply to normal users, administrators, contractors, third-party users, and service or system credentials where relevant.

2. Positively identify the user before issuing credentials

Credential allocation should be based on verified identity and approved business need.

Examples:

Do not issue or reset credentials based only on an informal email or chat message.

3. Force change of temporary or default credentials

Initial temporary passwords and vendor defaults should be changed immediately or on first use.

Default credentials are not a minor hygiene issue. They are a common compromise route.

4. Advise personnel on handling responsibilities

Users should be told clearly that authentication information is secret and that they may be accountable for activity performed using their credentials.

User responsibilities should include:

• do not share credentials;
• do not write credentials where others can see them;
• do not reuse organizational passwords in personal systems;
• protect recovery answers;
• use approved password managers where allowed;
• report suspected credential compromise;
• follow reset procedures;
• protect MFA devices and tokens.

5. Enforce technical credential controls where possible

Where systems can enforce credential rules, use them.

Controls may include:

• minimum length;
• complexity or passphrase requirements where appropriate;
• blocked common passwords;
• MFA;
• password history;
• lockout or throttling;
• secure reset;
• no default passwords;
• secure storage through hashing or vaulting;
• credential rotation for service secrets where appropriate.

Do not blindly apply old password-change rules. Frequency should be risk-based and consistent with the organization’s policy, system capability, and threat model.

6. Use compensating controls where systems cannot enforce rules

Legacy systems may not enforce modern credential controls.

Compensating controls can include:

• increased monitoring;
• restricted network access;
• vaulting;
• manual review;
• additional approval;
• MFA through a gateway;
• documented risk acceptance;
• planned replacement.

Audit guidance

Auditors should verify that authentication information is managed through a controlled process and that users understand their responsibilities.

Audit tests:

• review password/authentication policy;
• check technical settings against policy;
• sample initial credential allocation records;
• check user identity verification records;
• verify temporary/default credentials are changed;
• test password reset process design;
• review urgent reset process and follow-up;
• interview users at different levels;
• inspect whether credentials are written down or exposed;
• review password quality testing, if performed with approval.

Auditors should obtain proper management authority before testing or investigating sensitive authentication information.

Evidence examples

Strong evidence

• Credential allocation requires identity verification and authorization.
• Initial temporary credentials are changed on first use.
• Default vendor passwords are removed promptly.
• Technical settings match documented policy.
• Users acknowledge credential confidentiality responsibilities.
• Reset procedures verify identity and are logged.
• Urgent resets have follow-up review.
• Privileged credentials and secrets are vaulted or tightly controlled.
• Password quality checks are authorized and acted on.

Weak evidence

• Passwords sent in plain text without forced change.
• Default passwords remain in use.
• Users share accounts or credentials.
• Reset process relies only on informal manager email.
• Recovery questions use guessable public information.
• Technical settings do not match policy.
• Users do not know how to report suspected compromise.
• Passwords are visible on notes, spreadsheets, or chat history.

Common failures

Exam traps

• User IDs and email addresses are not secret authentication information.
• Passwords are common, but authentication information also includes PINs, recovery answers, biometric data/templates, tokens, and secrets.
• Authentication information management is not the same as identity management, but it supports identity management.
• Temporary and default credentials must be controlled and changed.
• Users should be advised that they are accountable for activity performed with their credentials.
• Shared credentials weaken accountability and should be avoided or tightly controlled.
• Password cracking or credential testing needs proper authorization.

Related controls and concepts

• A.5.15 Access Control
• A.5.16 Identity Management
• A.5.2 Information Security Roles and Responsibilities
• A.5.10 Acceptable Use of Information and Other Associated Assets
• Access Control Matrix
• Identity Lifecycle Register
• Internal Audit
• Risk Assessment

KB-ready summary

A.5.17 requires authentication information to be allocated and managed through a controlled process. Users must be identified before credentials are issued or reset, temporary and default credentials must be changed, users must be advised to protect secret authentication information, and technical controls should enforce policy where possible.

Templates and checklists

• Authentication Information Handling Standard
• A.5.17 Audit Checklist
• Identity Lifecycle Register
• Access Review Checklist