SekitCrosswalk
ENES
Start now
Cyber Essentials · derived mapping target

CE2.3Enforce device unlocking credentials

Require a biometric, password or PIN before a user can access a device that needs their physical presence, and protect that credential against brute-force guessing through attempt throttling or lock-out.

Mapping at a glance
CE2.3Enforce device unlocking credentialsCyber Essentials
RCF-0003Policy managementGovernance & Risk · TechnicalRCF-0078Password policyIdentity & Access Management · TechnicalRCF-0079Session managementIdentity & Access Management · PolicyRCF-0080Session managementIdentity & Access Management · ProcessRCF-0081Session managementIdentity & Access Management · Technical

CE2.3 is covered by 7 Sekit CSF controls. +2 more in the table below. Open in the full graph →

Mapped from the Sekit CSF

The Sekit controls that cover this requirement, lens by lens.

RCF-0003Policy management · TechnicalRCF-0078Password policy · TechnicalRCF-0079Session management · PolicyRCF-0080Session management · ProcessRCF-0081Session management · TechnicalRCF-0146Configuration baselines · ProcessRCF-0153MDM/MAM · Technical

ISO/IEC 27001:2022 counterparts

Reached through the Sekit CSF controls both map to — a mapping, not a formal equivalence.

A.8.1 User endpoint devicesA.8.9 Configuration managementA.8.5 Secure authenticationA.5.17 Authentication informationA.5.36 Compliance with policies, rules and standards for information securityA.5.15 Access controlA.5.37 Documented operating proceduresA.5.10 Acceptable use of information and other associated assetsA.7.7 Clear desk and clear screen

NIST CSF 2.0 counterparts

PR.AA-01 Identities and credentials managedPR.AA-02 Identities proofed and boundPR.AA-05 Access permissions managedPR.PS-01 Configuration management appliedPR.PS-02 Software maintainedGV.PO-02 Cybersecurity policy maintainedGV.PO-01 Cybersecurity policy established

Evidence that proves this control

What an auditor, or Sekit's evidence engine, asks for.

Password policy and manager
The company's password rules (length, complexity, expiry) and whether a password manager is used, plus how they are technically enforced.
Device hardening baseline
The secure-configuration standard applied to devices when handed out (default settings, disabled services) and how compliance is checked.
Mobile device management configuration
The tool that manages work phones and tablets, able to enforce security rules and remotely wipe a lost device.
From the Sekit evidence catalog

Related controls

Via the shared Sekit CSF topic, not the framework's own index.

CE2.1 Remove unnecessary accounts and softwareCE2.2 Change default and guessable passwordsCE4.4 Protect passwords against guessing
Ask Sekura: “What evidence proves CE2.3?”
Also via MCP, free with account