📋 ISO 27001 Cryptography: Password Storage Guide

Annex A.10 of ISO 27001:2022 governs cryptographic controls for information security, including the storage and protection of passwords. This is one of the most technically demanding areas of the standard because it requires organizations to implement encryption and hashing controls that are both effective and properly managed. For auditors, password storage is a critical area of focus because poor cryptographic practices are a leading cause of credential compromise in data breaches.

This guide examines the cryptographic requirements for password storage under ISO 27001:2022, covering acceptable hashing algorithms, key management practices, and implementation strategies that will satisfy certification auditors. Understanding these requirements is essential for any organization that stores user credentials or processes authentication data.

Understanding Annex A.10 Cryptographic Control Requirements

Annex A.10 of ISO 27001:2022 is divided into two control categories: A.10.1 (Cryptographic Controls) and A.10.2 (Key Management). A.10.1 requires organizations to develop and implement a policy for the use of cryptographic controls to protect information. For password storage, this means defining which hashing algorithms are acceptable, what parameters (salt length, work factor) must be used, and how cryptographic keys (if used) are managed throughout their lifecycle.

The standard does not prescribe specific algorithms. Instead, it requires that cryptographic controls be based on a formal risk assessment and comply with relevant regulations in your jurisdiction. This risk-based approach means organizations must stay current with cryptographic research and update their algorithms as weaknesses are discovered. What was considered secure five years ago — such as SHA-1 or bcrypt with a low cost factor — may no longer be acceptable under current guidelines.

A.10.2 addresses key management, which is relevant when passwords are encrypted rather than hashed (though hashing is strongly preferred). If your organization uses encryption for password storage at any layer, you must document key generation, distribution, storage, rotation, and destruction procedures. Keys must be stored separately from the data they protect, ideally in a hardware security module (HSM) or a cloud key management service.

Acceptable Hashing Algorithms for Password Storage

ISO 27001 does not name specific algorithms, but auditors reference industry best practices and national standards. The current consensus among security researchers and standards bodies is that passwords should be hashed using adaptive, memory-hard functions. The three most commonly accepted algorithms are bcrypt, Argon2, and scrypt, with PBKDF2 being acceptable in legacy systems with appropriately high iteration counts.

bcrypt remains the most widely deployed option due to its longevity and battle-tested implementation. It uses the Blowfish cipher and incorporates a configurable cost factor that makes it resistant to GPU-based brute force attacks. A cost factor of 10 or higher (2^10 iterations) is generally considered the minimum acceptable today, with 12 or higher recommended for new implementations.

Argon2 is the newer standard, having won the Password Hashing Competition in 2015. It offers three variants: Argon2d (resistant to GPU attacks), Argon2i (resistant to side-channel attacks), and Argon2id (a hybrid). Argon2id is recommended for most applications because it provides the best combination of security properties. Parameters should include a minimum memory of 64MB, at least 3 iterations, and a parallelism factor of 4.

scrypt is another memory-hard function that was designed specifically to resist large-scale custom hardware attacks. It is widely used in cryptocurrency systems and is supported by several programming language libraries. Its key advantage is that it requires a configurable amount of memory, making parallel attacks expensive. However, it is less commonly used for web applications than bcrypt or Argon2.

Simple hashing algorithms such as MD5, SHA-1, and unsalted SHA-256 are not acceptable under ISO 27001 for password storage. These algorithms are designed for speed and data integrity, not for resisting brute force attacks. Modern GPU hardware can compute billions of MD5 hashes per second, making even complex passwords recoverable in minutes or hours. If your organization still uses these algorithms, immediate remediation is required before certification.

Salt and Pepper: Essential Cryptographic Practices

A cryptographic salt is a random value generated for each password and stored alongside its hash. Salts ensure that identical passwords produce different hash values, preventing attackers from using precomputed rainbow tables. Under ISO 27001, the use of unique salts for every password is considered a basic security control. Each salt should be at least 16 bytes (128 bits) of cryptographically random data generated by a secure random number generator.

Some organizations implement a "pepper" — a secret value stored separately from the database that is added to passwords before hashing. While ISO 27001 does not explicitly require a pepper, it can be an effective additional control, particularly if your hashed password database could be exposed. The pepper should be stored in a secure location such as a secrets management system or HSM, and it should be rotated periodically according to your key management policy.

Combining salt and pepper with a strong, adaptive hashing algorithm creates defense in depth. Even if an attacker obtains your password database, they would need both the individual salts and the secret pepper value to begin cracking passwords. This layered approach aligns well with the ISO 27001 principle of implementing multiple, overlapping controls.

Password Storage Architecture for ISO 27001 Compliance

Your password storage architecture should be designed according to defense-in-depth principles. The password database should be isolated from application servers using network segmentation. Access to the database should require separate credentials from application access, and those credentials should be subject to the same rotation and monitoring controls you apply to other privileged accounts.

Application-layer hashing should use one of the acceptable algorithms mentioned above, with parameters that are reviewed and updated regularly. The hashing function should be implemented in a well-vetted library rather than custom code. Common libraries include bcrypt in Python (bcrypt package), Argon2 in JavaScript (argon2 npm package), and scrypt in Java (Bouncy Castle). Using established libraries reduces the risk of implementation errors that could weaken the cryptographic protection.

Consider implementing additional controls such as rate limiting on authentication endpoints to slow brute force attacks, account lockout after failed attempts, and anomaly detection for unusual authentication patterns. These compensating controls strengthen your overall password security posture and demonstrate the comprehensive approach that ISO 27001 auditors expect.

Key Management for Encrypted Password Storage

While hashing is preferred for password storage, some systems require reversible encryption (for example, legacy applications that need to retrieve plaintext passwords). If your organization uses encryption for password storage, you must implement a formal key management process that covers the entire key lifecycle: generation using a cryptographically secure random number generator, secure distribution to authorized systems only, secure storage in an HSM or key management service, periodic rotation according to your risk assessment, and secure destruction when keys are retired.

Auditors will expect documentation of your key management policy, including the algorithm used (AES-256-GCM is recommended), key length, key storage location, rotation schedule, and access controls for the key management system. Key encryption keys (KEKs) should be stored separately from data encryption keys (DEKs), and access to the key management system should require multi-person approval.

For cloud environments, AWS KMS, Azure Key Vault, and Google Cloud KMS all provide managed key management services that meet most ISO 27001 requirements out of the box. These services automate key rotation, provide audit logging, and enforce access controls through IAM policies. Using a managed service reduces the operational burden while maintaining compliance.

Audit Evidence for Cryptographic Controls

During an ISO 27001 certification audit, you will need to demonstrate both the design and operation of your cryptographic controls. Documents you should prepare include your cryptographic policy and procedure documents, your risk assessment justifying the selected algorithms and parameters, configuration documentation for your password hashing implementation, evidence of regular reviews of cryptographic controls, key management documentation (if applicable), and results from cryptographic testing or vulnerability assessments.

For the initial certification audit (Stage 2), you will need to demonstrate that your controls have been operating effectively for a period of time. This means maintaining logs of password hashing operations, key rotation events, and periodic reviews. Any gaps in coverage — systems that use outdated algorithms or lack proper salting — should be documented with remediation plans and management-approved timelines for resolution.

Common Cryptographic Password Storage Audit Findings

The most frequent findings in this area include use of outdated hashing algorithms (MD5, SHA-1) for password storage, insufficient work factors on acceptable algorithms (bcrypt cost factor below 10), missing or duplicate salts across passwords, lack of a formal cryptographic policy document, and inadequate key management procedures. Each of these findings can result in a non-conformity that requires remediation before certification can be granted.

Another common issue is inconsistent application of cryptographic controls across the environment. A central application may use bcrypt with appropriate parameters, but a legacy subsidiary application may still use unsalted SHA-256. ISO 27001 requires consistent application of controls across the entire scope of your ISMS. Organizations should conduct a comprehensive inventory of all systems that store passwords and assess each one against the cryptographic policy.

Conclusion: Building a Compliant Password Storage Program

ISO 27001 cryptographic requirements for password storage demand careful attention to technical detail and thorough documentation. By implementing strong, adaptive hashing algorithms, using unique salts for every password, maintaining proper key management practices, and documenting your entire cryptographic architecture, you can satisfy auditor requirements while meaningfully protecting your users' credentials.

The landscape of cryptographic security evolves continuously. Algorithms that are acceptable today may be compromised tomorrow. Regular reviews of your cryptographic controls — at least annually, or whenever significant cryptographic research is published — ensure that your password storage remains compliant and secure. Using a password manager like NordPass can help centralize and automate many of these controls, providing a clear audit trail and consistent cryptographic practices across your organization.