Cyber Essentials · derived mapping target
CE4.4Protect passwords against guessing
Defend password-based accounts against brute-force attacks (for example via MFA, throttling or lock-out) and enforce password quality, such as a minimum length of 12 characters, or 8 characters with a common-password deny list.
Mapping at a glance
CE4.4Protect passwords against guessingCyber Essentials
RCF-0064Strong authentication (MFA)Identity & Access Management · PolicyRCF-0066Strong authentication (MFA)Identity & Access Management · TechnicalRCF-0076Password policyIdentity & Access Management · PolicyRCF-0077Password policyIdentity & Access Management · ProcessRCF-0078Password policyIdentity & Access Management · Technical
CE4.4 is covered by 6 Sekit CSF controls. +1 more in the table below. Open in the full graph →
Mapped from the Sekit CSF
The Sekit controls that cover this requirement, lens by lens.
RCF-0064Strong authentication (MFA) · PolicyRCF-0066Strong authentication (MFA) · TechnicalRCF-0076Password policy · PolicyRCF-0077Password policy · ProcessRCF-0078Password policy · TechnicalRCF-0189VPN management · Technical
ISO/IEC 27001:2022 counterparts
Reached through the Sekit CSF controls both map to — a mapping, not a formal equivalence.
NIST CSF 2.0 counterparts
Evidence that proves this control
What an auditor, or Sekit's evidence engine, asks for.
MFA enrollment evidence
The proof that a second verification step (beyond the password) is required to access important systems.
Password policy and manager
The company's password rules (length, complexity, expiry) and whether a password manager is used, plus how they are technically enforced.
From the Sekit evidence catalog
Related controls
Via the shared Sekit CSF topic, not the framework's own index.
Ask Sekura: “What evidence proves CE4.4?”
Also via MCP, free with account