5.16

5.5.2.1 Organizations shall implement multi-factor authentication or document all instances where they cannot or make the business decision not to do so.

5.5.2.2 Organizations shall enforce password changes on suspicion or evidence of compromise.

5.5.2.3 Organizations shall have clear policies on password length and reuse, the use of password managers and if, when, and how users can physically write down and securely store a password.
NOTE: Organizations may use password selection guidance from the Communications Security Establishment’s User Authentication Guidance for Information Technology Systems

5.5.3.1 Organizations shall implement a password manager or document the business decision not to do so.
NOTE: Guidance document – Guidance documents as references to the Bibliography.
https://www.cyber.gc.ca/en/guidance/best-practices-passphrases-and-passwords-itsap30032