5.34

4.3.2.1 (b) The organization shall train employees on basic security practices, including a focus on the following practical and easily implementable measures:
a. The use of effective password policies (see Subsection 5.5);
b. Identification of malicious emails and links;
c. Use of approved software;
d. Appropriate usage of the Internet; and
e. Safe use of social media;

5.5.2.1 Organizations shall implement multi-factor authentication or document all instances where they cannot or make the business decision not to do so.

5.5.2.2 Organizations shall enforce password changes on suspicion or evidence of compromise.

5.5.2.3 Organizations shall have clear policies on password length and reuse, the use of password managers and if, when, and how users can physically write down and securely store a password.
NOTE: Organizations may use password selection guidance from the Communications Security Establishment’s User Authentication Guidance for Information Technology Systems

5.5.3.1 Organizations shall implement a password manager or document the business decision not to do so.
NOTE: Guidance document – Guidance documents as references to the Bibliography.
https://www.cyber.gc.ca/en/guidance/best-practices-passphrases-and-passwords-itsap30032