5.5.2.3
Use Strong User Authentication
Password Length, Managers, and Physical Usage
Use Strong User Authentication – Password Length, Managers, and Physical Usage – Organizations shall have clear policies on password length and reuse, the use of password managers and if, when, and how users can physically write down and securely store a password.
-
5.16 Identity Management: Manage the entire identity life cycle.
5.34 Privacy and Protection of PII: The organization should recognize and fulfill obligations for preserving privacy and safeguarding Personally Identifiable Information (PII) in accordance with relevant laws, regulations, and contracts.
-
3.4.5 Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems.
3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems.
3.5.7 Enforce a minimum password complexity and change of characters when new passwords are created.
3.5.8 Prohibit password reuse for a specified number of generations.
3.5.9 Allow temporary password use for system logons with an immediate change to a permanent password.
3.5.10 Store and transmit only cryptographically-protected passwords.
-
3.4.5 Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems.
3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems.
3.5.7 Enforce a minimum password complexity and change of characters when new passwords are created.
3.5.8 Prohibit password reuse for a specified number of generations.
3.5.9 Allow temporary password use for system logons with an immediate change to a permanent password.
3.5.10 Store and transmit only cryptographically-protected passwords.