5.5.2.2
Use Strong User Authentication
Password Change on Suspicion or Evidence of a Compromise
Use Strong User Authentication – Password Change on Suspicion or Evidence of a Compromise – Organizations shall enforce password changes on suspicion or evidence of compromise.
-
5.16 Identity Management: Manage the entire identity life cycle.
5.34 Privacy and Protection of PII: The organization should recognize and fulfill obligations for preserving privacy and safeguarding Personally Identifiable Information (PII) in accordance with relevant laws, regulations, and contracts.
-
3.4.5 Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems.
3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems.
3.5.9 Allow temporary password use for system logons with an immediate change to a permanent password.
3.5.10 Store and transmit only cryptographically-protected passwords.
-
3.4.5 Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems.
3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems.
3.5.9 Allow temporary password use for system logons with an immediate change to a permanent password.
3.5.10 Store and transmit only cryptographically-protected passwords.