All 93 controls · Organizational controls
Control 5.17
Authentication information
What ISO/IEC 27002:2022 control 5.17 asks for, in our own words, with the five published attribute values, the evidence an auditor asks for and the gaps commonly found. ISO/IEC 27028 is the guidance that explains how to use these values.
What the control asks
A management process is to control how authentication information is allocated and managed, and it includes telling personnel how to handle such information properly. Purpose: make entity authentication work correctly and prevent authentication processes from failing. Guidance on allocation: temporary passwords or PINs generated at enrolment are unguessable, unique per person and must be changed after first use; a user's identity is verified before new, replacement or temporary authentication information is issued; authentication information is delivered securely over an authenticated, protected channel and never in clear text email; users confirm receipt; vendor default credentials are changed immediately after installation; and significant allocation and management events are recorded confidentially using an approved method such as a password vault. User responsibilities: keep secret authentication information confidential and never share personal secrets, with secrets for shared or non-personal identities disclosed only to authorized people; change credentials at once when compromise is notified or suspected; choose strong passwords that are not guessable from personal details, not dictionary words, use memorable passphrases with mixed characters and meet a minimum length; do not reuse passwords across services; and have these duties written into employment terms (6.2). A password management system should let users choose and change passwords with a confirmation step, enforce strength, force change at first login, force change when needed (after an incident, or when someone who knew a shared password leaves or changes job), block reuse, reject common passwords and credentials known from breaches, hide passwords as typed, and store and transmit them protected, with hashing and encryption per approved cryptography (8.24). Other information: keys, smart card tokens and biometrics are other forms of authentication information (see ISO/IEC 24760); forcing frequent password changes can backfire; SSO and password vaults reduce what users must protect but raise the impact of a disclosure; where an independent authority assigns passwords, the user-selection, first-login and forced-change items do not apply.
Purpose in the standard’s terms, in our words: Ensures proper entity authentication and prevents authentication process failures.
Attribute values in one line: Preventive; Confidentiality, Integrity, Availability; Protect; Identity and access management; Protection.
The five attribute values
These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.
| Control type | Preventive |
|---|---|
| Information security properties | ConfidentialityIntegrityAvailability |
| Cybersecurity concepts | Protect |
| Operational capabilities | Identity and access management |
| Security domains | Protection |
Evidence an auditor asks for
The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.
- Credential issuance procedure requiring identity verification before new, replacement or temporary credentials are provided
- Evidence that initial credentials are unique, delivered over protected channels and changed at first use
- Password policy and technical configuration showing length, complexity, reuse prevention, breached-password blocking and masked entry
- Records of vendor default credentials being changed at installation
- Employment terms containing the user duties for authentication information
- An approved password vault or secret store holding records of credential allocation, with evidence that passwords are stored hashed using approved techniques
Where audits commonly find gaps
- Initial passwords are sent in clear text email or use a predictable pattern
- Default vendor credentials remain on network devices or appliances
- Shared account passwords are not changed when someone who knew them leaves
- No check against known breached passwords is performed
What ISO/IEC 27028 changes for this control
It carries a single control type, preventive, which sets what the evidence has to prove. It contributes no detect function, so a control set built from this row alone would not show detection. Its earlier numbering (09.2.4, 09.3.1) is kept in the register so an older audit file can still be traced.
The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.
Controls that share its values
Source for this page
- ISO/IEC 27002:2022, the control catalogue and Table A.1. The reference record of the 93 controls, their five attribute values, purpose, evidence and gaps. The published standard is at https://www.iso.org/standard/75652.html.
- ISO/IEC 27028, official record. Stage 60.00 under publication, edition 1, committee, abstract and the dated lifecycle. Retrieved 20 October 2026.
Retrieved 2026-10-20. The requirement above is our statement of the clause in our own words; the official text is linked so you can check it.
The attribute kit, USD 799 one off. The 109-row register with all five values, the evidence list, a dated plan and the extension worksheet, as PDF, CSV and XLSX.