🏛️ ISO/IEC 27001:2022 Annex A Access Control: Password Policy Requirements

ISO/IEC 27001:2022 Annex A Access Control: Password Policy Requirements

ISO/IEC 27001:2022 is the international standard for information security management systems (ISMS). Annex A control 5.15 (Access Control) and 5.17 (Authentication Information) contain the password-specific requirements organisations must implement for certification.

Relevant Annex A Controls for Passwords

What ISO 27001:2022 Requires for Passwords

Control 5.17 — Authentication Information

This is the primary control governing passwords. The standard requires:

1. Secret storage: Passwords must be hashed and salted, never stored in plaintext
2. Transmission security: Passwords must be encrypted in transit
3. Initial passwords: Temporary passwords must be changed on first use
4. No hardcoded passwords: Application code must not contain embedded credentials
5. Password reset: Must verify identity before allowing reset
6. Default passwords: Must be changed before system deployment

Control 8.5 — Secure Authentication

For systems handling sensitive information, additional requirements:

• Multi-factor authentication for remote access and privileged accounts
• Strong authentication mechanisms (beyond simple passwords)
• Session timeout after inactivity
• Failed attempt logging and alerting

Interpretive Guidance for Auditors

ISO 27001:2022 doesn't specify exact password length or complexity (unlike PCI-DSS or NIST). Instead, it requires that you define and document your organisation's password policy based on risk assessment.

What auditors look for:

Recommended Password Policy for ISO 27001 Compliance

Here's a policy template that passes most ISO 27001 audits:

password_policy:
  minimum_length: 12 characters
  complexity: optional (no mandatory character types)
  maximum_age: none (only change on compromise)
  history: last 5 passwords remembered
  lockout: 5 failed attempts = 15-minute lockout
  storage: bcrypt or Argon2 hashed
  transmission: TLS 1.2+ for all auth requests
  default_passwords: must change within 24 hours of deployment
  sharing: prohibited
  resets: verified identity before reset, new password different from old
  review: annual policy review and risk reassessment

Common ISO 27001 Audit Findings

• Shared accounts without compensating controls (most common finding)
• No password policy document approved by management
• Service accounts with non-expiring, never-changed passwords
• Default passwords still active on network equipment
• No failed login monitoring or response process

Integration with Other Standards

ISO 27001:2022 maps well to NIST SP 800-53 and CIS Controls. If you're already compliant with NIST guidance, you're 80% of the way to ISO 27001 password compliance.

Bottom line: ISO 27001 doesn't dictate exact password rules but requires a documented, risk-based policy that's technically enforced and regularly reviewed. Document, train, monitor, repeat.

ISO/IEC 27001:2022 Annex A: Access Control and Password Policy

ISO/IEC 27001:2022 is the internationally recognised standard for information security management systems (ISMS). Annex A of the standard provides a catalogue of reference controls that organisations select and implement based on their risk assessment and statement of applicability. Access control sits at the heart of this catalogue because most security incidents involve the misuse, theft, or weak protection of credentials. A robust password policy is one of the most visible and practical expressions of these access control requirements, translating high-level governance into rules that every user encounters daily.

Where Password Policy Fits in Annex A

The 2022 revision restructured Annex A into four themes: organisational, people, physical, and technological controls. Password management is addressed primarily through controls such as identity management, authentication information, and access rights. These controls require organisations to govern how credentials are created, distributed, stored, used, and revoked. Rather than prescribing a single fixed rule, the standard expects each organisation to define a policy proportionate to its risk appetite, regulatory obligations, and the sensitivity of the assets being protected.

Core Requirements of a Compliant Password Policy

An effective password policy aligned with ISO/IEC 27001:2022 typically establishes clear, enforceable rules for secret authentication information. The policy should be documented, approved by management, communicated to all users, and reviewed at planned intervals. Key elements commonly include the following:

• Minimum length and complexity requirements that resist brute-force and dictionary attacks, favouring longer passphrases over short complex strings.
• Prohibition of default, shared, and easily guessable passwords, with checks against known breached-password lists.
• Secure storage using salted cryptographic hashing rather than plaintext or reversible encryption.
• Secure distribution of temporary credentials and forced change on first login.
• Rules governing reuse, history, and the conditions under which passwords must change, ideally event-driven rather than arbitrary expiry.
• Account lockout or throttling thresholds following repeated failed authentication attempts.
• Protection of credentials in transit through encrypted channels.

Multi-Factor Authentication and Modern Practice

Passwords alone are increasingly insufficient. The standard encourages strong authentication, and most organisations now layer multi-factor authentication (MFA) on top of passwords for privileged accounts, remote access, and sensitive systems. Aligning the policy with contemporary guidance, such as that issued by national cyber security agencies, helps avoid counterproductive practices like frequent forced rotation, which often leads users to choose weaker, predictable variations. The goal is to balance security with usability so that controls are followed rather than circumvented.

Implementation and Enforcement

A policy on paper achieves little without technical enforcement. Directory services, identity providers, and single sign-on platforms should configure password rules centrally so that requirements are applied consistently across the estate. Automated tools can screen for weak or compromised passwords, enforce lockout thresholds, and log authentication events for monitoring. Privileged access management solutions add further control for administrative accounts, often combining vaulting, rotation, and session recording. Enforcement must extend to service accounts and machine identities, which are frequently overlooked yet represent a significant attack surface.

Auditing, Evidence, and Continual Improvement

Certification and surveillance audits require demonstrable evidence that the password policy exists, is communicated, and is operating effectively. Organisations should retain the approved policy document, records of user acknowledgement, configuration screenshots or exports, and logs showing enforcement and incident handling. Internal audits and management reviews should evaluate whether the controls remain adequate as threats evolve, feeding findings into the continual improvement cycle that underpins the entire ISMS.

Conclusion

Password policy under ISO/IEC 27001:2022 Annex A is far more than a list of complexity rules. It is a risk-driven, documented, and enforced component of access control that protects authentication information throughout its lifecycle. By combining sensible password requirements, multi-factor authentication, centralised enforcement, and rigorous auditing, organisations strengthen their security posture and provide the assurance that certification demands while keeping controls practical for the people who must use them every day.