SekitCrosswalk
ENES
Start now
Cyber Essentials · derived mapping target

CE2.2Change default and guessable passwords

Replace any default or easily guessed account password on a device, and disable auto-run features that would let downloaded files execute without the user's say-so.

Mapping at a glance
CE2.2Change default and guessable passwordsCyber Essentials
RCF-0003Policy managementGovernance & Risk · TechnicalRCF-0076Password policyIdentity & Access Management · PolicyRCF-0145Configuration baselinesEndpoint Security · PolicyRCF-0146Configuration baselinesEndpoint Security · ProcessRCF-0161Device hardeningEndpoint Security · Process

CE2.2 is covered by 18 Sekit CSF controls. +13 more in the table below. Open in the full graph →

Mapped from the Sekit CSF

The Sekit controls that cover this requirement, lens by lens.

RCF-0003Policy management · TechnicalRCF-0076Password policy · PolicyRCF-0145Configuration baselines · PolicyRCF-0146Configuration baselines · ProcessRCF-0161Device hardening · ProcessRCF-0191Wireless security · ProcessRCF-0192Wireless security · TechnicalRCF-0223Configuration management · PolicyRCF-0224Configuration management · ProcessRCF-0226Baseline compliance · PolicyRCF-0227Baseline compliance · ProcessRCF-0332Shared responsibility model · ProcessRCF-0333Shared responsibility model · TechnicalRCF-0338CSPM posture · ProcessRCF-0339CSPM posture · TechnicalRCF-0352SaaS security configuration · PolicyRCF-0353SaaS security configuration · ProcessRCF-0354SaaS security configuration · Technical

ISO/IEC 27001:2022 counterparts

Reached through the Sekit CSF controls both map to — a mapping, not a formal equivalence.

A.8.9 Configuration managementA.5.1 Policies for information securityA.8.16 Monitoring activitiesA.5.36 Compliance with policies, rules and standards for information securityA.5.23 Information security for use of cloud servicesA.8.20 Networks securityA.5.22 Monitoring, review and change management of supplier servicesA.8.1 User endpoint devicesA.5.37 Documented operating proceduresA.8.22 Segregation of networksA.5.17 Authentication information

NIST CSF 2.0 counterparts

PR.PS-01 Configuration management appliedPR.PS-02 Software maintainedPR.AA-05 Access permissions managedPR.IR-01 Networks protected from unauthorized accessDE.CM-01 Networks monitoredID.RA-01 Vulnerabilities identified and recordedGV.OC-04 Critical objectives and services understoodGV.SC-01 Supply chain risk program establishedGV.SC-05 Supply chain requirements in contractsPR.AA-01 Identities and credentials managedGV.PO-02 Cybersecurity policy maintainedPR.AA-02 Identities proofed and boundGV.PO-01 Cybersecurity policy established

ISO/IEC 42001:2023 — Annex A counterparts

A.10.2 Allocation of responsibilities

Evidence that proves this control

What an auditor, or Sekit's evidence engine, asks for.

Password policy and manager
The company's password rules (length, complexity, expiry) and whether a password manager is used, plus how they are technically enforced.
Device hardening baseline
The secure-configuration standard applied to devices when handed out (default settings, disabled services) and how compliance is checked.
From the Sekit evidence catalog

Related controls

Via the shared Sekit CSF topic, not the framework's own index.

CE1.3 Block unauthenticated inbound trafficCE2.1 Remove unnecessary accounts and softwareCE2.3 Enforce device unlocking credentialsCE4.3 Require multi-factor authenticationCE4.4 Protect passwords against guessing
Ask Sekura: “What evidence proves CE2.2?”
Also via MCP, free with account