CVE-2026-109953

Training instructs users on protecting credentials from disclosure or unauthorized access.

Training records for security awareness and role-based training verify education on credential protection practices, tangibly reducing risks from mishandling or exposing credentials.

Protecting authenticator content from unauthorized disclosure and modification while requiring protective controls addresses insufficiently protected credentials.

Rules of behavior include credential protection and non-sharing requirements, reducing exposure of insufficiently protected credentials.

Terminating or revoking credentials stops use of insufficiently protected or lingering credentials post-termination.

Requiring confidentiality/integrity protection for stored credentials directly mitigates insufficiently protected credentials on disk or in configuration stores.

Credentials or keys delivered out-of-band are not exposed to interception or inadequate protection on the main transport.

A.5.10 only requires awareness, a topic-specific acceptable-use policy stating expected behaviours/monitoring, and procedures referencing other controls (e.g. access restrictions, marking, disposal); it performs none of the verb on CWE-522's insecure credential transmission/storage, which requires technical protections like encryption or secure channels that this governance clause does not supply.

A.5.17 mandates secure allocation, transmission, storage, hashing/encryption per 8.24, strong non-reusable passwords, immediate change of defaults/compromise, and no cleartext — directly stopping exploitation of insufficiently protected credentials with only a bounded remainder (e.g. non-password authenticators or post-storage exposure vectors outside its scope).

A.6.2 sets contractual terms, NDAs, and communicates responsibilities to personnel; it has no technical effect on how credentials are protected in transmission or storage and cannot stop exploitation of CWE-522

Regular reminders about password security and personal accountability make users less likely to store or transmit credentials in cleartext or other unprotected forms.

A.8.24's purpose, guidance (b,c), and key management mandate proper cryptography (algorithms, strength, protection of credentials in storage/transmission) per classification, which stops exploitation of insufficiently-protected credentials; remainder is bounded (e.g. non-cryptographic protections like hashing-only or non-crypto obfuscation per CWE-522 details).

A.8.5 mandates MFA, alternative strong methods, no cleartext transmission/storage of passwords, session termination, brute-force protection and secure log-on procedures that directly stop interception/retrieval of credentials even when they exist, leaving only a bounded remainder (e.g. non-password credentials or post-authentication storage outside log-on flows)