Sekit CSF · Identity & Access Management · Process
RCF-0077Password policy
Employees consistently use a password manager and follow password hygiene
Mapping at a glance
RCF-0077Password policyIdentity & Access Management · Process
A.5.17Authentication informationISO/IEC 27001:2022 · Annex A controlsA.6.3Information security awareness, education and trainingISO/IEC 27001:2022 · Annex A controlsPR.AA-01Identities and credentials managedNIST CSF 2.0PR.AA-02Identities proofed and boundNIST CSF 2.0CE4.4Protect passwords against guessingCyber Essentials
RCF-0077 maps to 5 controls across the published frameworks. Open in the full graph →
Maps to ISO/IEC 27001:2022 · Annex A controls
Curated mapping with the reasoning, not just the codes.
A.5.17Authentication informationsupportsGetting every employee onto the password manager is what makes the written password rules real, rather than rules people work around with reused passwords.A.6.3Information security awareness, education and trainingrelatedThis process control gets employees actively using a password manager for unique credentials, a hygiene outcome that awareness training under A.6.3 is meant to instill.
Maps to NIST CSF 2.0
Curated mapping with the reasoning, not just the codes.
Maps to Cyber Essentials
Curated mapping with the reasoning, not just the codes.
Evidence that proves this control
What an auditor, or Sekit's evidence engine, asks for.
Password policy and manager
The company's password rules (length, complexity, expiry) and whether a password manager is used, plus how they are technically enforced.
From the Sekit evidence catalog
This topic through the other lenses
All Identity & Access Management controls
Ask Sekura: “What evidence proves RCF-0077?”
Connect your AI · free MCP
https://sekit.ai/api/mcp/crosswalk- In Claude or ChatGPT, add a custom connector and paste this URL.
- Sign in with your email to finish. Free, read-only, no organization required.