A.5.17 Organizational
Authentication information
Structured attributes from ISO/IEC 27002:2022 — control type · CIA properties · cybersecurity concept · operational capability · security domain. What do these mean?
The implementation guidance for this control is published in
ISO/IEC 27002:2022
and is not reproduced here. The structured attributes and the cross-walk
rationales below are derived facts and our own AI-authored analysis.
Mapped NIST 800-53 r5 controls (11)
Our AI-authored reading (authority llm_unverified, under review) of how this ISO control and each NIST 800-53 control relate. Not an ISO or NIST product.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- IA-5mostlycovers — Both controls establish requirements for the secure issuance, distribution, storage, and lifecycle management of authenticators including password strength, change enforcement, and protection against reuse or compromise.
- AC-2partialaligns with — Both address the management of user accounts and associated credentials, including issuance of temporary or replacement authenticators and revocation upon personnel changes.
- AC-6partialaligns with — Both emphasize limiting the exposure and sharing of authentication information to only those with a legitimate need, supporting the principle of least privilege for credentials.
- IA-2partialaligns with — Both require reliable identification and authentication mechanisms, with the ISO control providing the detailed authenticator-management practices that enable the IA-2 objective.
- SC-12partialaligns with — Both require cryptographic protection of authentication secrets during storage and transmission, ensuring confidentiality of passwords and similar credentials.
Aligned NIST CSF 2.0 outcomes (10)
NIST CSF 2.0 outcomes this ISO control aligns with — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- PR.AA-01mostlycovers — The ISO control's detailed rules for issuing, protecting, and rotating credentials directly implement the CSF outcome of managing identities and credentials for authorized users and services.
- PR.AA-02mostlyaligns with — Verification of user identity before issuing or resetting authentication information aligns with the CSF requirement to proof identities and bind them to credentials based on interaction context.
- PR.AA-03partialaligns with — Enforcing strong, non-reusable passwords and secure transmission supports the CSF outcome that users, services, and hardware must be authenticated before access.
- PR.AA-05partialaligns with — Requirements to change default credentials, prevent reuse, and enforce policy-driven password rules contribute to the CSF outcome of defining, managing, and reviewing access permissions and authorizations.
- PR.PS-01partialaligns with — Mandating immediate replacement of vendor defaults and use of approved password vaults are configuration-management practices that the CSF places under platform security.
Related OWASP ASVS 5.0 requirements (15)
Application-security verification requirements (OWASP ASVS 5.0) this ISO control aligns with; links open the ASVS chapter. Our AI-authored analysis (authority llm_unverified, under review) — many ISO controls have no ASVS counterpart.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- V6.2.12fullcovers — ISO's explicit prohibition on compromised username/password pairs from hacked systems matches the ASVS requirement to check passwords against a set of breached passwords.
- V6.2.2fullcovers — The ISO stipulation that users must be able to select and change their own passwords with a confirmation step implements the ASVS rule that users can change their password.
- V6.2.3fullcovers — ISO's requirement for a confirmation procedure when changing passwords corresponds to the ASVS rule that password change functionality must require both the current and new password.
- V6.2.4fullcovers — The ISO mandate to block commonly-used and previously compromised passwords aligns exactly with the ASVS requirement to check submitted passwords against at least the top 10000 breached passwords.
- V6.2.6fullcovers — The ISO directive that passwords must not be displayed on screen when entered directly satisfies the ASVS requirement that password input fields use type=password to mask entry.
- V6.2.8fullcovers — ISO's requirement to store and transmit passwords only in protected form aligns with the ASVS rule that the application verifies the user's password exactly as received without any modifications such as truncation.
- V6.4.1fullcovers — The ISO requirement that automatically generated temporary credentials be non-guessable, unique, and changed at first use directly implements the ASVS rule that system-generated initial passwords must be securely random and follow the existing password policy.
- V6.2.10mostlyaligns with — ISO's rule that passwords remain valid until a compromise is detected or the user rotates them aligns with the ASVS requirement that passwords stay valid until discovered compromised or rotated by the user.
Related weaknesses / CWE (65)
Weakness classes this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
CWE-1390→PCWE-1391←F →MCWE-1393←P →MCWE-200→MCWE-256←F →PCWE-257←F →PCWE-258←P →PCWE-260←PCWE-261←PCWE-262←PCWE-263←PCWE-287→MCWE-288←PCWE-289←PCWE-290←M →PCWE-291←PCWE-302←PCWE-304←MCWE-308←MCWE-309←FCWE-324←P →PCWE-384←PCWE-521→MCWE-522→MCWE-523←PCWE-526←P →PCWE-555←PCWE-620←PCWE-640←PCWE-645←PCWE-654←MCWE-836←FCWE-916←P
Why these map — AI rationale (under review)
- CWE-1391mostlyprevents — Directly requires secure generation, distribution and storage of authentication credentials, eliminating default/hard-coded weak passwords.
- CWE-1393mostlyprevents — Mandates secure handling and change of authentication secrets, directly addressing default passwords.
- CWE-200mostlyprevents — Secure delivery, protected storage, and confidentiality of allocation records limit exposure of authentication material to unauthorized observers.
- CWE-287mostlyprevents — Verifying user identity before issuing replacement credentials and forcing changes after compromise reduces the likelihood that authentication bypass can be achieved through stolen or weak credentials.
- CWE-521mostlyprevents — Enforcing minimum length, complexity, non-dictionary, and non-reuse rules directly counters weak password policies that allow attackers to guess or brute-force credentials.
- CWE-522mostlyprevents — Requiring protected storage, transmission, and non-display of passwords prevents credentials from being stored or sent in clear text where they can be harvested by unauthorized actors.
- CWE-1390partialprevents — Strong-password and non-reuse requirements raise the bar against weak single-factor authentication that can be exploited via guessing or credential stuffing.
- CWE-256partialprevents — Directly requires secure handling and protection of authentication information, preventing plaintext password storage.
- CWE-257partialprevents — Directly requires secure handling and protection of authentication information, preventing storage in recoverable formats.
- CWE-258partialprevents — Requires secure handling and protection of authentication credentials, directly addressing empty passwords in config files.
- CWE-290partialprevents — Authentication information management directly addresses credential handling that prevents spoofing.
- CWE-324partialprevents — Authentication information policy should mandate key rotation and expiry, directly preventing use of expired keys.
- CWE-526partialmitigates — Authentication secrets are a common type of sensitive information; the control requires protecting them, which this weakness violates.
- CWE-259noneprevents — Requiring users to change temporary or default passwords at first use stops the continued existence of hard-coded or guessable passwords that are shipped with the product.
- CWE-260nonenone — Directly requires secure generation, storage and handling of authentication secrets, preventing passwords in config files.
- CWE-261nonenone — Requires secure handling and protection of authentication information, directly addressing weak password encoding.
- CWE-262nonenone — Requires policies and procedures for managing authentication information including password lifecycle.
- CWE-263nonemitigates — Requires policies for managing authentication credentials including password lifetime.
- CWE-288nonenone — Authentication information management ensures credentials and mechanisms are consistently applied across all access paths.
- CWE-289nonenone — Proper management of authentication credentials can include rules against duplicate or alias identities.
- CWE-291nonenone — Authentication-information rules discourage reliance on mutable attributes such as IP addresses.
- CWE-302nonenone — Proper management of authentication information prevents use of client-controlled tokens or cookies as sole proof of identity.
- CWE-304nonenone — Directly requires secure management of authentication credentials and processes, preventing skipped critical steps.
- CWE-308nonenone — Authentication information control directly addresses the need for strong, multi-factor credentials.
- CWE-309nonemitigates — Authentication information control explicitly governs the lifecycle and strength of passwords and alternatives.
- CWE-322nonenone — Authentication information management ensures credentials are properly issued and verified prior to key exchange.
- CWE-384nonenone — Authentication-information rules can include session-token lifecycle requirements, but the control focuses on credential management.
- CWE-408nonenone — Authentication information management supports proper credential handling but does not directly address operation ordering.
- CWE-523nonenone — Addresses management of authentication information, indirectly supporting protection during transmission.
- CWE-555nonenone — Requires secure handling and storage of authentication credentials, directly addressing plaintext passwords in config files.
- CWE-620nonenone — Requires secure management of authentication information, directly addressing the need to verify the original password before allowing a change.
- CWE-640nonemitigates — Strong authentication-information lifecycle rules directly address weak password-recovery flows.
- CWE-645nonenone — Authentication information management includes setting lockout parameters that balance security against accidental lockouts.
- CWE-654nonenone — Authentication information rules directly address single-factor reliance by requiring stronger mechanisms.
- CWE-798nonenone — Mandating immediate replacement of vendor-supplied default credentials eliminates the use of hard-coded or factory passwords that attackers can trivially obtain from documentation or firmware.
- CWE-836nonenone — Directly requires secure handling and protection of authentication credentials, preventing storage or comparison of password hashes as if they were passwords.
- CWE-916nonenone — Requires secure handling of authentication information, which includes choosing strong password hashing schemes.
Mitigated MITRE ATT&CK techniques (5)
Adversary techniques (MITRE ATT&CK Enterprise) this ISO control helps mitigate; links open attack.mitre.org. Our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- T1078mostlyprevents — Requiring immediate change of default or temporary credentials and verifying user identity before issuing replacements limits the viability of using vendor-supplied or stolen valid accounts.
- T1110partialmitigates — Enforcing strong, non-guessable, unique passwords and blocking reuse or common/compromised values directly reduces the success rate of password guessing, spraying, and credential-stuffing attempts.
- T1552partialprevents — Mandating secure transmission, protected storage, and non-display of passwords reduces the chance that credentials are left in clear text files, registry entries, or other unsecured locations.
- T1003nonemitigates — By ensuring credentials are never transmitted or stored in plaintext and are changed after compromise indicators, the control lowers the payoff from credential-dumping activities.
- T1555nonemitigates — Requiring protected storage and transmission of passwords and prohibiting sharing reduces the usefulness of harvesting credentials from browsers, password managers, or other local stores.
Prevented OWASP Web Top 10 (2025) risks (4)
OWASP Web Top 10 (2025) risk categories this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- A07mostlyprevents — By enforcing unique, non-guessable credentials, secure delivery, mandatory first-use changes, and strong password policies, the control directly stops weak or predictable authentication material from ever being introduced into the application.
- A01partialprevents — By ensuring credentials are issued only after verified identity checks and are changed on compromise or role change, the control reduces the likelihood that an attacker can leverage stale or shared accounts to bypass access controls.
- A02partialprevents — Mandating immediate replacement of vendor defaults and prohibiting reuse of compromised or common passwords removes the most common misconfiguration vectors that leave authentication surfaces exposed.
- A04noneprevents — Requiring protected transmission, storage, and approved cryptographic hashing of passwords eliminates the use of clear-text or weakly-protected credential data that would otherwise constitute a cryptographic failure.
Control IDs, short titles and the structured attribute table (control type, CIA properties, cybersecurity-concept, operational capability, security domain) are facts from ISO/IEC 27001:2022 Annex A / ISO/IEC 27002:2022. The full implementation guidance prose lives in ISO/IEC 27002:2022 — not reproduced here. Cross-walks to NIST 800-53, NIST CSF 2.0, OWASP ASVS, CWE, MITRE ATT&CK and OWASP Web Top 10 are our own AI-authored analysis (authority llm_unverified, under review), not an ISO, NIST, MITRE or OWASP product — how ours compare.