Sekit CSF · Identity & Access Management · Technical
RCF-0078Password policy
Strong password requirements are technically enforced at the system level
Mapping at a glance
RCF-0078Password policyIdentity & Access Management · Technical
RCF-0078 maps to 6 controls across the published frameworks. +1 more in the table below. Open in the full graph →
Maps to ISO/IEC 27001:2022
Curated mapping with the reasoning, not just the codes.
A.5.17Authentication informationsupportsRejecting weak or short passwords in system configuration enforces A.5.17's credential rules technically, closing the gap between what the policy says and what the system allows.A.8.5Secure authenticationsupportsPassword rules are enforced in system configuration so weak passwords are rejected by the identity provider and key applications, not merely discouraged on paper.
Maps to NIST CSF 2.0
Curated mapping with the reasoning, not just the codes.
Maps to Cyber Essentials
Curated mapping with the reasoning, not just the codes.
Evidence that proves this control
What an auditor, or Sekit's evidence engine, asks for.
Password policy and manager
The company's password rules (length, complexity, expiry) and whether a password manager is used, plus how they are technically enforced.
From the Sekit evidence catalog
This topic through the other lenses
All Identity & Access Management controls
Ask Sekura: “What evidence proves RCF-0078?”
Also via MCP, free with account