Sekit CSF · Identity & Access Management · Policy
RCF-0076Password policy
Strong password requirements are formally defined and communicated
Mapping at a glance
RCF-0076Password policyIdentity & Access Management · Policy
A.5.1Policies for information securityISO/IEC 27001:2022 · Annex A controlsA.5.17Authentication informationISO/IEC 27001:2022 · Annex A controlsPR.AA-01Identities and credentials managedNIST CSF 2.0PR.AA-02Identities proofed and boundNIST CSF 2.0CE2.2Change default and guessable passwordsCyber Essentials
RCF-0076 maps to 6 controls across the published frameworks. +1 more in the table below. Open in the full graph →
Maps to ISO/IEC 27001:2022 · Annex A controls
Curated mapping with the reasoning, not just the codes.
A.5.1Policies for information securitysupportsAmong A.5.1's topic-specific policies, Sekit's Password policy sets minimum length, bans reuse across services, and requires a password manager for staff credentials.A.5.17Authentication informationsupportsDocumenting minimum length, no reuse, mandatory password-manager use and shared-credential handling supports A.5.17's authentication information requirement, though credential issuance and non-human secrets are covered by other controls.
Maps to NIST CSF 2.0
Curated mapping with the reasoning, not just the codes.
Maps to Cyber Essentials
Curated mapping with the reasoning, not just the codes.
Evidence that proves this control
What an auditor, or Sekit's evidence engine, asks for.
Password policy and manager
The company's password rules (length, complexity, expiry) and whether a password manager is used, plus how they are technically enforced.
From the Sekit evidence catalog
This topic through the other lenses
All Identity & Access Management controls
Ask Sekura: “What evidence proves RCF-0076?”
Connect your AI · free MCP
https://sekit.ai/api/mcp/crosswalk- In Claude or ChatGPT, add a custom connector and paste this URL.
- Sign in with your email to finish. Free, read-only, no organization required.