Cyber Resilience

← ISO 27001 Annex A

A.5.17 Organizational

Authentication information

AttributesPreventive C·I·A Protect Identity and access management Protection

Structured attributes from ISO/IEC 27002:2022 — control type · CIA properties · cybersecurity concept · operational capability · security domain. What do these mean?

The implementation guidance for this control is published in ISO/IEC 27002:2022 and is not reproduced here. The structured attributes and the cross-walk rationales below are derived facts and our own AI-authored analysis.

Mapped NIST 800-53 r5 controls (20)

Our AI-authored reading (authority llm_unverified, under review) of how this ISO control and each NIST 800-53 control relate. Not an ISO or NIST product.

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

AC-2←M →P AC-7←P IA-2←M →M IA-4←M IA-5←M →M IA-6←F IA-8←M SC-13←M SC-17←P SC-28←M SC-8←M

Why these map — AI rationale (under review)

IA-2mostlycovers — A.5.17's full set of requirements for protecting and handling authentication information (issuance, protection, storage, transmission, use) accounts for the bulk of what IA-2 requires to achieve unique identification and authentication of organizational users, but leaves a residual slice (explicit association of the authenticated identity with processes acting on the user's behalf) uncovered.
IA-5mostlycovers — Both controls establish requirements for the secure issuance, distribution, storage, and lifecycle management of authenticators including password strength, change enforcement, and protection against reuse or compromise.
AC-2partialaligns with — Both address the management of user accounts and associated credentials, including issuance of temporary or replacement authenticators and revocation upon personnel changes.
AC-6partialaligns with — Both emphasize limiting the exposure and sharing of authentication information to only those with a legitimate need, supporting the principle of least privilege for credentials.
IA-2partialaligns with — Both require reliable identification and authentication mechanisms, with the ISO control providing the detailed authenticator-management practices that enable the IA-2 objective.
SC-12partialaligns with — Both require cryptographic protection of authentication secrets during storage and transmission, ensuring confidentiality of passwords and similar credentials.
AC-6covers — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
SC-12covers — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.

Aligned NIST CSF 2.0 outcomes (16)

NIST CSF 2.0 outcomes this ISO control aligns with — our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

PR.AA-01←F →M PR.AA-02gov PR.AA-03gov PR.AA-05gov PR.AT-01gov PR.PS-01gov

Why these map — AI rationale (under review)

PR.AA-01mostlycovers — The ISO control's detailed rules for issuing, protecting, and rotating credentials directly implement the CSF outcome of managing identities and credentials for authorized users and services.
PR.AA-02mostlyaligns with — Verification of user identity before issuing or resetting authentication information aligns with the CSF requirement to proof identities and bind them to credentials based on interaction context.
PR.AA-03partialaligns with — Enforcing strong, non-reusable passwords and secure transmission supports the CSF outcome that users, services, and hardware must be authenticated before access.
PR.AA-05partialaligns with — Requirements to change default credentials, prevent reuse, and enforce policy-driven password rules contribute to the CSF outcome of defining, managing, and reviewing access permissions and authorizations.
PR.PS-01partialaligns with — Mandating immediate replacement of vendor defaults and use of approved password vaults are configuration-management practices that the CSF places under platform security.
PR.AA-02implements — A.5.17 operationalizes identity proofing and credential binding (the exact subject of PR.AA-02) within the authentication domain, though the control does not name proofing/binding explicitly
PR.AA-03implements — A.5.17 directly operationalizes entity authentication to achieve the exact outcome named in PR.AA-03
PR.AA-05implements — A.5.17 operationalizes proper entity authentication which is a core means within the PR.AA-05 domain of defining/managing/enforcing access permissions and authorizations (including least privilege), though the outcome does not name authentication explicitly
PR.PS-01implements — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.

Related OWASP ASVS 5.0 requirements (15)

Application-security verification requirements (OWASP ASVS 5.0) this ISO control aligns with; links open the ASVS chapter. Our AI-authored analysis (authority llm_unverified, under review) — many ISO controls have no ASVS counterpart.

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

V11.4.2←F V6.2.1←M V6.2.10→M V6.2.12←M →F V6.2.2→F V6.2.3→F V6.2.4←F →F V6.2.6→F V6.2.8←M →F V6.3.1←M V6.4.1←F →F

Why these map — AI rationale (under review)

V6.2.12fullcovers — ISO's explicit prohibition on compromised username/password pairs from hacked systems matches the ASVS requirement to check passwords against a set of breached passwords.
V6.2.2fullcovers — The ISO stipulation that users must be able to select and change their own passwords with a confirmation step implements the ASVS rule that users can change their password.
V6.2.3fullcovers — ISO's requirement for a confirmation procedure when changing passwords corresponds to the ASVS rule that password change functionality must require both the current and new password.
V6.2.4fullcovers — The ISO mandate to block commonly-used and previously compromised passwords aligns exactly with the ASVS requirement to check submitted passwords against at least the top 10000 breached passwords.
V6.2.6fullcovers — The ISO directive that passwords must not be displayed on screen when entered directly satisfies the ASVS requirement that password input fields use type=password to mask entry.
V6.2.8fullcovers — ISO's requirement to store and transmit passwords only in protected form aligns with the ASVS rule that the application verifies the user's password exactly as received without any modifications such as truncation.
V6.4.1fullcovers — The ISO requirement that automatically generated temporary credentials be non-guessable, unique, and changed at first use directly implements the ASVS rule that system-generated initial passwords must be securely random and follow the existing password policy.
V6.2.10mostlyaligns with — ISO's rule that passwords remain valid until a compromise is detected or the user rotates them aligns with the ASVS requirement that passwords stay valid until discovered compromised or rotated by the user.

Related weaknesses / CWE (45)

Weakness classes this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

Why these map — AI rationale (under review)

CWE-259noneprevents — Requiring users to change temporary or default passwords at first use stops the continued existence of hard-coded or guessable passwords that are shipped with the product.
CWE-263nonemitigates — Requires policies for managing authentication credentials including password lifetime.
CWE-309nonemitigates — Authentication information control explicitly governs the lifecycle and strength of passwords and alternatives.
CWE-640nonemitigates — Strong authentication-information lifecycle rules directly address weak password-recovery flows.
CWE-1390prevents — Strong-password and non-reuse requirements raise the bar against weak single-factor authentication that can be exploited via guessing or credential stuffing.
CWE-1391prevents — Directly requires secure generation, distribution and storage of authentication credentials, eliminating default/hard-coded weak passwords.
CWE-1393prevents — Mandates secure handling and change of authentication secrets, directly addressing default passwords.
CWE-200prevents — Secure delivery, protected storage, and confidentiality of allocation records limit exposure of authentication material to unauthorized observers.
CWE-256prevents — Directly requires secure handling and protection of authentication information, preventing plaintext password storage.
CWE-257prevents — Directly requires secure handling and protection of authentication information, preventing storage in recoverable formats.
CWE-258prevents — Requires secure handling and protection of authentication credentials, directly addressing empty passwords in config files.
CWE-287prevents — Verifying user identity before issuing replacement credentials and forcing changes after compromise reduces the likelihood that authentication bypass can be achieved through stolen or weak credentials.
CWE-290prevents — Authentication information management directly addresses credential handling that prevents spoofing.
CWE-324prevents — Authentication information policy should mandate key rotation and expiry, directly preventing use of expired keys.
CWE-521prevents — Enforcing minimum length, complexity, non-dictionary, and non-reuse rules directly counters weak password policies that allow attackers to guess or brute-force credentials.
CWE-522prevents — Requiring protected storage, transmission, and non-display of passwords prevents credentials from being stored or sent in clear text where they can be harvested by unauthorized actors.
CWE-526mitigates — Authentication secrets are a common type of sensitive information; the control requires protecting them, which this weakness violates.

Mitigated MITRE ATT&CK techniques (361)

Adversary techniques (MITRE ATT&CK Enterprise) this ISO control helps mitigate; links open attack.mitre.org. Our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

T1001.003←M T1003→P T1003.001←M T1003.002←P T1003.004←M →P T1003.005←P T1003.008→P T1006←M T1021→M T1021.001→P T1021.002←P →P T1021.003→P T1021.004→M T1021.005→P T1021.006→P T1021.007←P →P T1021.008→P T1027.014←M T1027.016←M T1036←M T1036.003←M T1036.005←M T1036.008←M T1036.009←M T1040→P T1055←M T1055.001←M T1055.002←M T1055.003←M T1055.004←M T1055.005←M T1055.008←M T1055.009←M T1055.011←M T1055.012←M T1055.013←M T1055.014←M T1055.015←M T1056←M →P T1056.001←M →P T1056.002←M T1056.004←M T1070←P T1070.008←M T1071.003←M T1071.004←M T1078→M T1078.001→M T1078.002→M T1078.003→M T1078.004→M T1098←P →P T1098.001←M →P T1098.004←M T1098.005→P T1102←M T1110→M T1110.001→M T1110.002→M T1110.003→M T1110.004→M T1111←M →P T1127←M T1127.001←M T1127.003←M T1133→P T1134←M T1134.001←M T1134.003←M T1136→P T1137.001→P T1137.005→P T1185←M T1187→P T1199←M T1207←M T1211←P T1212←P T1216←M T1218←M T1218.005←M T1218.007←M T1218.008←M T1218.010←M T1218.011←M T1218.013←M T1219.003←M T1221←M T1222←M T1480.001←M T1484←M T1484.002←M T1496.004→P T1528←P →P T1530←P →P T1531←P T1534←M →P T1535←M T1538→M T1539←F →P T1542←M T1542.002←M T1546.012←P T1548←M T1548.002←P T1548.003←P T1548.006←M T1550→P T1550.001←F T1550.003←F T1550.004←F T1552←M →P T1552.001→P T1552.004→P T1552.008→P T1553.002←P T1553.003←M T1553.004←M T1553.006←M T1554←P T1555←M →P T1555.002←P T1555.003→P T1555.005←P →P T1556→P T1556.002←F T1556.003←M T1556.004←M T1556.005←M →P T1556.006←M T1556.007←M T1556.008←F T1556.009←M T1557←M →P T1557.001←P T1557.004←M T1558←M →P T1558.001←M →P T1558.002←M →P T1558.003→P T1558.004→P T1563.001←M T1563.002←M →P T1564.001←P T1566→P T1566.002→P T1566.003←M T1566.004→P T1571←M T1572←M T1574←M T1574.001←M T1574.013←M T1578←P T1578.001←M T1578.002←M T1578.003←M T1578.004←M T1584.001→P T1586→P T1586.001←P →P T1586.002→P T1586.003→P T1589→P T1589.001→P T1598→P T1598.001←M T1598.003→P T1598.004←M T1599←M T1600←M T1600.001←P T1600.002←P T1601.001←P T1601.002←P T1606←M →P T1606.001←F →P T1606.002←M T1620←M T1621←M T1647←P T1657→P T1665←P T1671←M T1683.002←M T1684→P T1684.002←M T1685←M T1685.002←M T1685.003←M T1685.004←M T1685.005←M T1685.006←M T1686←F T1686.001←M T1687←M T1688←M T1689←P T1690←M

Why these map — AI rationale (under review)

T1003prevents — A.5.17 mandates strong, unique, non-reusable, protected passwords (with secure allocation, transmission, hashing, no defaults, immediate changes on compromise) which stops many common credential-dumping paths that rely on weak, guessable, reused, or default creds, but does not stop dumping of already-strong credentials from memory, LSASS, or structures once obtained.
T1003.004prevents — A.5.17 mandates secure generation, transmission, storage (protected form with approved crypto), default changes, non-reuse, and strong-password rules that directly stop many LSA secrets from containing guessable/weak/default/reused credentials, but does not stop an adversary with SYSTEM from reading whatever secrets are present in the registry or memory.
T1003.008prevents — A.5.17's password management system requirements (strong non-reusable passwords, hashing per 8.24, no cleartext transmission, immediate change of defaults) raise the bar for successful offline cracking of any dumped hashes, directly constraining the technique's goal of enabling usable cracked credentials; it does not stop the adversary from reading/dumping the files themselves when they already have sufficient privileges.
T1021prevents — A.5.17 directly mandates generation of non-guessable credentials, secure issuance, immediate change of defaults/temporary secrets, strong-password enforcement, no-reuse, and protection of stored/transmitted secrets, which stops most paths to obtaining the valid accounts that T1021 requires; the bounded remainder is post-compromise credential use or non-password remote-service vectors (e.g., Kerberos tickets, SSH keys) that the control does not reach.
T1021.001prevents — A.5.17's allocation, transmission, change-on-compromise, strong-password enforcement, password-management-system rules, and first-login change directly stop adversaries from acquiring or using guessable/reused/default/compromised credentials needed to authenticate over RDP with valid accounts.
T1021.002prevents — A.5.17's focus on strong, unique, non-reusable, promptly changed, and securely transmitted authentication information (including defaults and after compromise) prevents many classes of credential compromise that could enable Valid Accounts for SMB admin share access, but leaves residual paths such as Pass-the-Hash, stolen NTLM hashes, or already-compromised admin accounts.
T1021.003prevents — A.5.17's focus on strong, unique, non-reusable, promptly changed, and properly transmitted credentials (plus password management rules) prevents adversaries from obtaining or retaining the valid accounts needed to abuse DCOM, but leaves the DCOM mechanism itself and non-password auth vectors untouched.
T1021.004prevents — A.5.17 directly mandates generation of non-guessable unique credentials, secure transmission, immediate change of defaults, strong password enforcement, no reuse, blocking of compromised passwords, and protected storage/transmission, which stops most password-based SSH logins with valid but weak/compromised credentials; key-based auth and already-compromised long-lived keys remain outside its reach.
T1021.005prevents — A.5.17 directly mandates generation of non-guessable unique credentials, secure transmission, immediate change of defaults/temporary secrets, strong-password enforcement, prevention of reuse/common passwords, and protected storage/transmission, which stops the credential-abuse vector (including brute-force on VNC-specific auth) that enables T1021.005; the bounded remainder is that VNC can still fall back to system accounts whose passwords are obtained by other means.
T1021.006detects — A.5.17's logging of significant allocation/management events and user-responsibility rules (e.g. report compromise) can surface anomalous or compromised credential use that enables WinRM, but this is narrow, post-facto, and does not broadly instrument WinRM sessions or the technique itself.
T1021.006prevents — A.5.17's requirements for strong, unique, non-reusable, immediately-changed credentials and secure transmission directly stop many (but not all) ways an adversary can obtain or retain the valid accounts needed to execute T1021.006 via WinRM.
T1021.007prevents — A.5.17's allocation, transmission, change-on-first-use, strong-password enforcement, no-reuse, and protected-storage rules directly stop many password-based or default-credential attacks against federated/cloud logins, but the technique also succeeds via tokens, compromised on-prem accounts, or MFA bypass that the control does not address.
T1021.008prevents — A.5.17's allocation, transmission, default-change, strong-password enforcement, and compromise-response rules directly stop many password/token/SSH-key based abuses of valid accounts for direct cloud VM console access, but leave untouched non-password vectors, misconfigured cloud IAM defaults, and post-compromise credential use that the technique can still employ.
T1040prevents — A.5.17 mandates secure transmission of authentication information (protected channels, no cleartext email), immediate change of defaults, strong non-reusable passwords, and protected storage/transmission, which stops many forms of credential capture via sniffing of insecure protocols but leaves residual cases (e.g. already-compromised channels, non-password auth, or post-TLS-termination cloud mirroring) untouched.
T1056prevents — A.5.17 mandates strong non-guessable passwords, secure transmission, immediate change of defaults/temporary secrets, no reuse, and user training against sharing/compromise, which stops many phishing-style or credential-harvesting input-capture techniques that rely on weak/reused/default creds, but leaves transparent hooking (T1056.004) and many post-capture uses untouched.
T1056.001prevents — A.5.17's password management rules (strong non-reusable secrets, first-login change, protected transmission/storage, no defaults) prevent the captured keystrokes from yielding usable credentials in many common cases, but do nothing against the keylogger itself or against non-password credentials (e.g. biometrics, tokens, or already-cached sessions).
T1078prevents — Requiring immediate change of default or temporary credentials and verifying user identity before issuing replacements limits the viability of using vendor-supplied or stolen valid accounts.
T1078.001prevents — A.5.17 explicitly requires immediate post-installation change of all default/vendor/factory authentication information (item e) plus strong-password enforcement, first-login forced change, and no-reuse rules that stop default accounts from remaining usable.
T1078.002prevents — A.5.17 directly mandates generation of non-guessable unique credentials, immediate change of defaults/temporaries, strong-password enforcement, no-reuse, no-common-compromised-passwords, secure transmission, and prompt change on compromise notification — all of which stop the password-reuse and weak-credential vectors named in the T1078.002 prose; the named remainder is credential dumping (T1003) which the control does not address.
T1078.003prevents — A.5.17 directly mandates generation of non-guessable unique temporary secrets, immediate change of defaults, strong-password enforcement, no reuse, no common/compromised passwords, secure transmission, and prompt change on compromise — all of which stop the credential-obtainment and password-reuse vectors that enable T1078.003; the bounded remainder is adversary theft of already-valid local credentials (e.g., via dumping or shoulder-surfing) that the control does not address.
T1078.004prevents — A.5.17 directly mandates generation of non-guessable unique credentials, secure transmission, immediate change of defaults, strong-password enforcement, no-reuse, blocking of compromised passwords, and prompt change on compromise notification, which stops the credential-acquisition vectors (brute force, phishing for defaults/shared/weak creds, reuse) that enable T1078.004; the bounded remainder is post-compromise persistence via Additional Cloud Credentials or misconfigured role assumptions that the control does not reach.
T1098detects — A.5.17 mandates keeping records of significant events in allocation/management of authentication information (and using approved tools such as password vaults), which can surface anomalous password changes or resets that are a core subset of T1098 account manipulation; this is only a slice of the technique (e.g., no coverage of permission-group changes, container/identity-provider actions, or non-password credential manipulation).
T1098prevents — A.5.17's password management rules (enforce changes, prevent reuse, block common/compromised passwords, force first-login change, strong selection) directly stop the iterative password-update technique that subverts duration policies to preserve compromised credentials, but the control is silent on other T1098 manipulations such as permission-group changes, credential modifications that are not password-based, or account creation.
T1098.001prevents — A.5.17's password management rules (strong generation, no reuse, immediate change of defaults/temporary creds, secure transmission, no sharing) directly stop many of the password- and key-based credential-addition methods described in T1098.001, but leave untouched SSH keypair creation/import, access-key APIs, federation-token issuance, and non-password credential types that dominate large slices of the technique.
T1098.005prevents — A.5.17's requirements for secure allocation, identity verification before issuing/replacing auth info, secure transmission, immediate change of defaults, strong password enforcement, and preventing reuse/compromise directly stop the credential-compromise path that lets an adversary self-enroll a device in MFA or Intune, but do not address the separate vector of an already-authenticated adversary registering devices to bypass conditional access or exhaust services.
T1110detects — A.5.17 mandates keeping records of significant events in authentication information allocation/management (including via approved tools like password vaults) and requires users to report compromise, which can surface brute-force attempts or related anomalies but only for a narrow slice of the technique (e.g., initial allocation or post-compromise indicators) rather than general detection of systematic guessing across platforms and scenarios.
T1110prevents — A.5.17 mandates non-guessable unique initial secrets, immediate change of defaults, strong password enforcement, no reuse, blocking of common/compromised passwords, and protected transmission/storage, which directly stops most systematic guessing (online or against weak/default/reused hashes) described in T1110; the bounded remainder is offline attacks against already-strong, non-reused, non-compromised hashes obtained post-breach.
T1110.001detects — A.5.17 mandates records of significant events in authentication information allocation/management plus user notification of compromise, which can surface some guessing attempts (especially those triggering lockouts or policy violations), but the control is scoped to credential lifecycle and does not require broad monitoring of authentication failures or guessing across services.
T1110.001prevents — A.5.17 mandates non-guessable defaults, immediate change of vendor defaults, strong password enforcement, prevention of reuse/common/compromised passwords, and secure allocation/transmission, which directly stops most systematic guessing of common or weak passwords; the bounded remainder is that it does not stop all guessing (e.g., against strong unique passwords or MFA-exempted accounts).
T1110.002prevents — A.5.17 mandates generation of non-guessable unique secrets, immediate change of defaults/temporaries, strong-password enforcement, prohibition of reuse/common/compromised values, and protected storage/transmission, which directly stops the systematic guessing and rainbow-table attacks that define T1110.002; the bounded remainder is that it cannot stop an adversary who already possesses a sufficiently strong cracked password or who cracks via methods outside the control's password-management scope.
T1110.003prevents — A.5.17 mandates non-guessable unique initial secrets, immediate change of defaults, strong-password enforcement, prevention of common/compromised password reuse, and protected transmission/storage, which directly stops the small list of common passwords used in spraying from being valid or selectable in the first place.
T1110.004detects — A.5.17 requires records of significant events in authentication information allocation/management plus user notification of compromise, which can surface credential-stuffing attempts or post-breach reuse indicators, but the control is scoped to issuance, user responsibilities, and password-system mechanics rather than broad monitoring of authentication failures or anomalous login patterns across services.
T1110.004prevents — A.5.17 directly prevents credential stuffing by mandating non-reuse of passwords across services, strong non-guessable passwords, immediate changes on compromise, no defaults, and password management that blocks reuse/compromised combos, closing the overlap that the technique relies on; partial remainder exists for non-password auth or pre-existing shared creds before enforcement.
T1111prevents — A.5.17 mandates non-guessable unique temporary secrets, secure transmission, immediate change of defaults, strong password rules, no reuse, protection against common/compromised passwords, and protected storage/transmission; these directly stop many password-related MFA-interception vectors (e.g. keylogger-captured weak/reused/default passwords, insecure SMS/email transmission of OTPs) but leave hardware-token seed compromise, real-time proxying of live smart-card sessions, and certain out-of-band provider compromises untouched.
T1133prevents — A.5.17's requirements for strong, unique, non-reusable, protected, and promptly changed authentication information (including for remote-service gateways) directly block the dominant credential-based vector for T1133, but the technique also succeeds via exposed unauthenticated services, Tor hidden services, and post-compromise credential theft, leaving a substantial unaddressed slice.
T1136prevents — A.5.17's password management, default-changing, non-guessable generation, and user-responsibility rules stop many weak or backdoor-like account creations but do not address account creation itself, privileged creation paths, or non-password credentialed accounts on all listed platforms.
T1137.001prevents — A.5.17's password/credential management rules (strong non-reusable secrets, change-on-first-use, protected transmission/storage) can prevent an adversary from guessing or reusing stolen credentials needed to initially compromise a system or Office app and then modify templates/macros for persistence, but this is only a minority slice of the technique which primarily relies on post-compromise file/registry abuse rather than auth failures.
T1137.005prevents — A.5.17's password management, transmission, default-changing, and compromise-response requirements prevent the initial credential compromise that is the dominant prerequisite for an adversary to add malicious Outlook rules, but do not address rule creation, mailbox configuration, or non-password vectors such as token abuse or already-authenticated sessions.
T1187prevents — A.5.17 mandates secure allocation, transmission, strong non-reusable passwords, immediate changes on compromise, and protected storage/transmission of auth info, which directly counters many ways forced-auth hashes can be cracked or reused but does not stop the core technique of forcing an automatic outbound auth to an adversary-controlled resource.
T1496.004prevents — A.5.17's focus on secure allocation, transmission, strong/unique credentials, and immediate change of defaults or compromised auth info directly stops many initial compromises of SaaS accounts that adversaries then hijack for resource abuse, but leaves open post-compromise lateral use, service enabling, and non-auth vectors such as misconfigurations or insider abuse.
T1528prevents — A.5.17's allocation, transmission, change-on-compromise, strong-password, non-reuse, and protected-storage rules prevent many classes of token/secret theft (including OAuth phishing, default creds, guessable tokens, and cleartext exposure) but leave the post-compromise container/CI/CD/IMDS theft paths and refresh-token reuse untouched.
T1530prevents — A.5.17's focus on secure generation, transmission, storage, and management of authentication information (including forcing changes to defaults, preventing reuse/compromise, and enforcing strong non-guessable secrets) directly stops the credential-leakage vector that adversaries abuse to access cloud storage, but leaves the dominant misconfiguration vector (public/anonymous buckets without any auth) untouched.
T1534prevents — A.5.17's strong-password, non-reuse, change-on-compromise, transmission, and default-change rules reduce the chance that an initial credential compromise (the first stage of internal spearphishing) succeeds or persists, but do nothing against device takeover, post-compromise impersonation, or phishing via internal chat/apps that does not rely on weak credentials.
T1538prevents — A.5.17's allocation, transmission, change-on-compromise, strong-password enforcement, and password-management rules directly stop many stolen-credential scenarios that would let an adversary reach the cloud dashboard (including default creds, guessable passwords, reuse, and clear-text transmission), leaving only the bounded remainder of non-password auth or post-compromise credential theft that the control does not address.
T1539prevents — A.5.17's rules on secure allocation, transmission, immediate change of defaults/temporary secrets, non-reuse, strong generation, and protected storage/transmission of authentication information (including session tokens treated as such) stop many common ways session cookies become stealable at source or remain usable after compromise, but leave open JS injection, malicious proxy/AitM, memory scraping of live sessions, and post-theft use of already-valid long-lived cookies.
T1550prevents — A.5.17's password management, transmission, change-on-compromise, and non-reuse rules reduce the pool of stealable alternate material (e.g., hashes/tickets) and limit its post-theft usefulness, but do not stop the core technique of acquiring and using legitimately generated alternate auth material such as Kerberos tickets or access tokens.
T1552prevents — Mandating secure transmission, protected storage, and non-display of passwords reduces the chance that credentials are left in clear text files, registry entries, or other unsecured locations.
T1552.001prevents — A.5.17 mandates secure generation, transmission, storage (protected form, approved crypto, no cleartext), default changes, no reuse, strong selection, and immediate change on compromise — directly stopping most insecure credential storage in files/configs/backups that T1552.001 relies on, with a bounded remainder for pre-existing embedded credentials or unmanaged third-party files.
T1552.004prevents — A.5.17 mandates secure generation, transmission, storage, and management of authentication information (including changing defaults, protecting transmission, using strong protected forms, and avoiding reuse/compromise), which directly stops many insecure private-key storage cases that enable T1552.004; it leaves residual cases such as post-compromise export of in-use keys, device-generated transport keys, and network-device CLI export that the control does not reach.
T1552.008prevents — A.5.17's rules on secure transmission of auth info, avoiding cleartext email, strong non-reused passwords, immediate change on compromise, and protected storage directly stop many (but not all) ways credentials get shared insecurely in chat, especially user-driven password sharing; the technique's broader scope (API keys, tokens, integration-tool scraping, server/portal access) remains unaddressed.
T1555prevents — A.5.17 mandates secure generation, transmission, storage, strong-password enforcement, change-on-compromise, no-reuse, and protected forms that directly stop many common password-store locations and extraction paths from being usable or fruitful; the bounded remainder is post-compromise memory-resident or non-password credential stores outside the control's password-management scope.
T1555.003prevents — A.5.17 mandates secure generation, transmission, storage, strength enforcement, change-on-compromise, and non-reuse of authentication secrets (including passwords), which directly stops many browser-credential extraction paths (weak/default creds, cleartext transmission, reuse across services, easy-to-crack values) but leaves the core technique of reading protected browser stores or dumping process memory intact when strong, properly managed credentials are already present.
T1555.005prevents — A.5.17 mandates secure generation, transmission, storage, strong-password enforcement, change-on-compromise, and approved vault tools for authentication information including password-manager masters, which directly stops many acquisition paths (especially guessing, reuse, weak defaults, and clear-text exposure) but leaves memory-extraction and post-unlock exploitation vectors (T1212) untouched.
T1556prevents — A.5.17 hardens allocation, transmission, user handling, and password-management-system behaviors that directly stop many common ways an adversary can modify an authentication process (e.g., default creds, weak/reused passwords, clear-text transmission, no change-on-compromise), but leaves the core modification of LSASS/PAM/SAM mechanisms or plugins themselves untouched.
T1556.005prevents — A.5.17 mandates strong non-reversible password storage, immediate change of defaults, protected transmission, and enforcement against weak/compromised passwords, which directly counters enabling reversible encryption and the resulting plaintext exposure in most standard cases; it leaves the legacy-software exception and AD-specific FGPP/GPO manipulation as a bounded remainder.
T1557prevents — A.5.17 mandates secure allocation, transmission, strong non-reusable passwords, protected storage/transmission, and immediate change of defaults/compromise — directly stopping many AiTM follow-ons (sniffing/replay of weak/default creds, downgrade-enabled interception) but leaves ARP/DNS/LLMNR poisoning, session-cookie theft, and non-credential traffic manipulation untouched.
T1558prevents — A.5.17's password management, transmission, change-on-compromise, and strong-password rules constrain credential theft vectors that feed Kerberos ticket forgery or Pass-the-Ticket, but do not address ticket extraction from memory, golden/silver ticket forgery, or protocol-level Kerberos abuses on Linux/macOS/Windows.
T1558.001prevents — A.5.17's password management, strong-password enforcement, change-on-compromise, non-reuse, and protected storage/transmission requirements harden KRBTGT credential handling and reduce the chance of hash compromise via dumping, but do not stop privileged domain-controller access or the forgery act itself once the hash is obtained.
T1558.002prevents — A.5.17's password management rules (strong unique non-reusable hashes, immediate change of defaults/compromise, protected storage/transmission) directly stop many ways service-account password hashes are obtained or remain usable for silver ticket forgery, but leave residual paths such as Kerberoasting of service principals that still require a password.
T1558.003prevents — A.5.17 mandates strong non-guessable passwords, immediate changes to defaults/temporary creds, no reuse, protection of stored/transmitted secrets, and avoidance of weak/compromised passwords; this directly blocks the offline brute-force step that succeeds against weak RC4-hashed service-account passwords, but leaves the upstream TGT acquisition, SPN enumeration, and RC4 etype-23 issuance untouched.
T1558.004prevents — A.5.17 mandates strong non-guessable passwords, immediate changes to defaults/temporary creds, secure transmission, no reuse, and protection against common/compromised passwords, which directly raises the cracking cost for AS-REP material obtained without pre-auth; it does not address the root technique of disabling or detecting pre-auth on accounts, leaving a substantial remainder.
T1563.002detects — A.5.17 requires records of significant events in authentication info allocation/management plus user notification of compromise, which can surface hijacking indicators (e.g. unexpected session changes or compromised creds) but does not mandate monitoring of RDP sessions, tscon.exe use, or lateral movement.
T1566prevents — A.5.17's requirements for strong non-reusable passwords, secure transmission, immediate change of defaults/temporary creds, and user training on not sharing or reusing them prevent the subset of phishing that relies on credential theft or weak/default authentication to gain access, but do not stop the dominant vectors of malicious attachments, links, or social engineering that lead to code execution without touching authentication information.
T1566.002prevents — A.5.17's strong-password, non-reuse, change-on-compromise, secure-transmission, and first-use-change rules raise the bar for credential-theft via consent-phishing/device-code-phishing links that harvest entered secrets, but do nothing against the dominant social-engineering lure, link-click execution, browser exploits, or IDN-homograph tricks that require no credential entry.
T1566.004prevents — A.5.17's rules on non-guessable/unique credentials, secure transmission, immediate change of defaults/compromise, strong password enforcement, MFA-adjacent practices, and user training on not sharing or divulging secrets directly constrain the success of vishing that tricks users into revealing or accepting authentication prompts, but leave social-engineering elements like urgency/impersonation and non-credential vectors (e.g. directing to malicious URLs or RAT installation) untouched.
T1584.001prevents — A.5.17's requirements for secure allocation, transmission, verification of identity before issuing/replacing auth info, immediate change of defaults, strong non-reusable passwords, and protected storage directly block the password-reset and account-compromise vectors used to hijack domain registration, but leave renewal gaps, social engineering of help desks, and subdomain/deprovisioned-resource hijacking untouched.
T1586prevents — A.5.17's password management, generation, transmission, change-on-compromise, and non-reuse rules directly block several listed compromise vectors (brute-force/reuse from dumps, weak/default creds, insecure transmission) but leave untouched purchasing credentials, insider sales, or phishing-for-credentials that bypass the technical controls.
T1586.001prevents — A.5.17's password management, strong-password enforcement, change-on-first-use, no-reuse, transmission protections, and compromise-response rules directly block the brute-force, credential-reuse-from-breach, and weak/default-password vectors named for compromising social-media accounts, but leave the distinct phishing-for-information and purchased-credentials vectors untouched.
T1586.002prevents — A.5.17's requirements for non-guessable/unique credentials, secure transmission, immediate default changes, strong password enforcement, no reuse, and protection against compromised passwords directly block the brute-force, credential-dump reuse, and weak/default-password vectors for acquiring email accounts, but leave the phishing-for-credentials, purchasing, and insider-payment vectors untouched.
T1586.003prevents — A.5.17 directly prevents the credential-compromise vectors named in the technique (password spraying, phishing-for-credentials, weak/default/reused/compromised passwords, insecure transmission) by mandating strong generation, secure issuance, user training, password-management enforcement, and cryptographic protection; it leaves the non-credential vectors (purchasing from third parties, stealing application access tokens, reconnaissance-driven targeting of privileged provider accounts) untouched.
T1589prevents — A.5.17's requirements for non-guessable unique credentials, secure transmission, immediate default changes, strong password enforcement, no reuse, and protected storage directly stop the adversary from obtaining usable credentials or MFA details via leaks, enumeration of weak/default auth, or exposed datasets, but do not address gathering of non-credential personal data (names, emails, security questions) via phishing, social media, or scanning.
T1589.001prevents — A.5.17's password management, generation, transmission, change-on-compromise, and non-reuse rules directly stop many common credential-gathering vectors (phishing elicitation, leaked defaults, reused personal/business passwords, breach dumps of weak creds) but leave untouched purchase of already-stolen credentials, MFA OTP compromise via provider breach, and cookie theft from compromised sites.
T1598prevents — A.5.17's requirements for secure allocation, transmission, strong non-reusable passwords, immediate changes on compromise, and user training on not sharing or divulging credentials reduce successful elicitation of usable authentication information via phishing but do not stop the social-engineering delivery or all forms of information gathering (e.g., non-credential data or callback phishing).
T1598.003prevents — A.5.17's password management rules, user training on not sharing/reusing/weak creds, secure transmission, and immediate change on compromise reduce successful credential harvest from phishing links but do not stop the social-engineering delivery, link-clicking, or non-credential forms of information elicitation.
T1606prevents — A.5.17's requirements for non-guessable/unique/temporary secrets, secure transmission, immediate default changes, strong password enforcement, no reuse, and protected storage directly block the password/PIN/seed-based forgery paths described in T1606, but leave the API-abuse paths (AssumeRole/GetFederationToken, zmprov) and private-key forging untouched.
T1606.001prevents — A.5.17 mandates generation of non-guessable unique secrets, secure transmission, immediate change of defaults, strong password selection, no reuse, protection of stored/transmitted values, and cryptographic handling; these directly stop the secret-value-dependent forgery step of T1606.001 for many cookie schemes, but leave a bounded remainder (e.g. schemes using only public/standardized values, non-password seeds, or post-generation use of already-compromised keys).
T1657prevents — A.5.17's focus on strong, unique, non-reusable, protected credentials and identity verification before issuance directly prevents the account compromise vector (T1586) that enables unauthorized fund transfers in financial theft, but leaves social engineering, ransomware extortion, BEC impersonation without credential compromise, and non-account-based methods untouched.
T1684prevents — A.5.17's requirements for secure allocation, transmission, user training on confidentiality/strong passwords, immediate change on compromise, and password management directly block many social-engineering vectors that rely on tricking users into disclosing, resetting, or reusing authentication info, but do not stop non-credential social engineering (e.g. financial approvals, executing payloads, or MFA changes without passwords).

Prevented OWASP Web Top 10 (2025) risks (16)

OWASP Web Top 10 (2025) risk categories this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

A02←P →P A04←P →P A07→M A09←M A10→P

Why these map — AI rationale (under review)

A02mitigates — A.5.17's password-management rules (change defaults immediately, enforce strong non-reused non-compromised passwords, protected storage/transmission) reduce the attack surface that weak or default credentials create, but do nothing for the far broader class of misconfigurations (incomplete hardening, exposed cloud/framework/server settings, error pages, permissions, headers, etc.) that define A02.
A02prevents — A.5.17 directly prevents the insecure-defaults slice of A02 by mandating immediate change of vendor/predefined defaults, non-guessable temporary secrets, strong-password enforcement, and no reuse of common/compromised passwords; it leaves the broader hardening, cloud, framework, and server misconfiguration surface untouched.
A04mitigates — A.5.17 requires secure transmission of authentication secrets (protected channels, no cleartext email) and protected storage/transmission of passwords, which bounds the blast radius of realized crypto failures for those specific secrets but does not address absent/weak/misused cryptography for other sensitive data or the broader class.
A04prevents — A.5.17 mandates secure generation, transmission, storage, and change of authentication secrets (including use of approved cryptography per 8.24), which directly prevents many cryptographic failures for credentials in transit, at rest, and in use; however, the control is scoped only to authentication information and does not address the broader class of sensitive data or non-credential cryptographic misuses.
A07mitigates — A.5.17 directly hardens credential issuance, transmission, strength, change, storage, and reset procedures, which bounds the blast radius or success rate of most listed authentication failures (weak reset flows, credential stuffing via weak/reused/compromised passwords, session hijacking via poor transmission/storage) even when the underlying auth mechanism is imperfect.
A07prevents — A.5.17 directly mandates generation of non-guessable unique credentials, identity verification before issuance, secure transmission, immediate change of defaults, strong-password enforcement, no reuse, protection against compromised lists, first-login forcing, and protected storage/transmission — all of which close the dominant authentication-failure vectors named in A07:2025 (weak credentials, credential stuffing, poor reset flows, session hijacking via predictable or leaked auth info).
A10mitigates — A.5.17's secure allocation, transmission, default-changing, compromise-response, and protected storage/transmission requirements limit the blast radius or consequence of authentication failures that reach an exceptional path, but do not address error-leakage, fail-open logic, or inconsistent states themselves.

Control IDs, short titles and the structured attribute table (control type, CIA properties, cybersecurity-concept, operational capability, security domain) are facts from ISO/IEC 27001:2022 Annex A / ISO/IEC 27002:2022. The full implementation guidance prose lives in ISO/IEC 27002:2022 — not reproduced here. Cross-walks to NIST 800-53, NIST CSF 2.0, OWASP ASVS, CWE, MITRE ATT&CK and OWASP Web Top 10 are our own AI-authored analysis (authority llm_unverified, under review), not an ISO, NIST, MITRE or OWASP product — how ours compare.