ISO 27001 Annex A 5.17 Management of authentication information

This control is broader than E8-MF-ML3.3.

E8-MF-ML3.3 requires phishing-resistant MFA for accessing data repositories. ISO/IEC 27001:2022 Annex A 5.17 is broader, requiring controlled allocation and management of authentication information (e.g., credential lifecycle and handling), which underpins how MFA credentials and authenticators are issued and governed. E8-MF-ML3.3 is a specific technical requirement that sits within the wider authentication management practices expected by Annex A 5.17.

This control partially overlaps E8-MF-ML1.4.

Annex A 5.17 requires controlled allocation and management of authentication information. E8-MF-ML1.4 relates by requiring MFA for users accessing services processing sensitive data, which introduces factors that need secure handling.

This control partially overlaps E8-MF-ML2.1.

Annex A 5.17 addresses establishing a management process for allocating and protecting authentication information and advising personnel on its handling. E8-MF-ML2.1 relates by mandating multi-factor authentication for privileged users, affecting how authentication factors are managed.

This control partially overlaps E8-RA-ML2.5.

Annex A 5.17 requires a controlled process for allocating and managing authentication information, including how credentials are handled by personnel and systems. E8-RA-ML2.5 relates by requiring administrator, service and break glass account credentials to be long, unique, unpredictable and managed, which is a targeted credential management requirement. E8-RA-ML2.5 is scoped to high-risk account types and credential quality/management, while Annex A 5.17 applies more generally to authentication information management across the organisation.

This control is broader than ISM-0485.

ISM-0485 requires that SSH connections use public key-based authentication rather than weaker authentication methods. Annex A 5.17 governs the broader allocation, handling, storage, and lifecycle management of authentication information (including keys, passwords, and other credentials). Implementing ISM-0485 is one specific application of Annex A 5.17 focused on SSH, but Annex A 5.17 extends well beyond SSH and public keys to cover all authentication information management processes.

This control is broader than ISM-1014.

ISM-1014 requires individual (unique) logins to be implemented for IP phones used for SECRET or TOP SECRET conversations. Annex A 5.17 governs the allocation and management of authentication information (e.g. issuing, protecting, and handling credentials) across the organisation, which would include credentials used to log into secure IP phones. ISM-1014 is a specific, high-assurance application of credential management focused on classified voice use, whereas Annex A 5.17 is broader and not specific to IP telephony or classification levels.

This control is broader than ISM-1560.

ISM-1560 requires passwords used for MFA on SECRET systems to be at least 8 characters, establishing a baseline for authentication information quality. Annex A 5.17 focuses on the management process for allocating, controlling, and advising personnel on handling authentication information (including passwords), which helps ensure such length rules are defined, communicated, and enforced consistently. ISM-1560 is a specific technical requirement, while Annex A 5.17 is governance/process-oriented and does not itself set password length or SECRET-specific constraints.

This control is broader than ISM-1594.

ISM-1594 requires that initial or reset human user credentials are delivered via a secure communications channel, or otherwise split and issued via two separate paths (user and supervisor). ISO/IEC 27001:2022 Annex A 5.17 requires an organisational process to control the allocation and management of authentication information, including guidance to personnel on handling it. ISM-1594 is a specific, prescriptive delivery/issuance safeguard that sits within (and operationalises part of) the broader authentication-information management process required by Annex A 5.17.

This control is broader than ISM-1595.

ISM-1595 requires credentials issued to human users to be changed on first use, ensuring they are only temporary. Annex A 5.17 mandates a controlled process for allocating and managing authentication information, which includes user guidance for secure handling. ISM-1595 represents a particular rule within the broader scope of the authentication management process outlined in Annex A 5.17.

This control is broader than ISM-1614.

ISM-1614 entails changing break glass credentials after emergency access by another party. Annex A 5.17 is broader, requiring a management process for authentication information across the organisation, including access change procedures like those in ISM-1614.

This control is broader than ISM-1829.

ISM-1829 requires that passwords are not stored in Group Policy Preferences, where they can be retrieved and decrypted by domain users. This is a specific rule for the secure handling of authentication information within the management process required by Annex A 5.17. Annex A 5.17 covers allocation, management and user guidance for all authentication information, while ISM-1829 addresses one storage location.

This control is broader than ISM-1840.

ISM-1840 requires that user account passwords are not stored using reversible encryption. ISO/IEC 27001:2022 Annex A 5.17 requires organisations to control the allocation and management of authentication information, which includes how passwords are stored and protected. ISM-1840 is a specific password-storage requirement within the broader governance and handling expectations of Annex A 5.17.

This control is broader than ISM-1875.

ISM-1875 requires systems to be scanned at least monthly to identify credentials stored in the clear. ISO/IEC 27001:2022 Annex A 5.17 requires an organisation-wide management process for allocation, handling and control of authentication information, which would include preventing and detecting insecure storage of credentials. ISM-1875 is a specific detective control within the broader governance and handling requirements of Annex A 5.17.

This control is broader than ISM-1888.

ISM-1888 mandates secure password-based lock screens on mobile devices to protect authentication. ISO/IEC 27001:2022 Annex A 5.17 covers the management of authentication information such as passwords and PINs, which supports the secure implementation of mobile lock screens.

This control is broader than ISM-1920.

ISM-1920 requires preventing MFA self-enrolment from untrustworthy devices to reduce account takeover risk for sensitive systems. ISO/IEC 27001:2022 Annex A 5.17 requires allocation and management of authentication information to be controlled by a management process, which can include controlled issuance/registration of MFA credentials and prohibiting unmanaged devices from performing enrolment. Annex A 5.17 is broader (all authentication information management), while ISM-1920 is a specific control on the enrolment pathway and device trust decision.

This control is broader than ISM-1930.

ISM-1930 requires organisations to prevent passwords being stored in Group Policy Preferences (GPP), removing a known mechanism for exposing plaintext/reversible credentials in domain environments. Annex A 5.17 requires broader governance and control over the allocation, management and handling of authentication information across the organisation. Preventing GPP password storage (ISM-1930) is one specific technical enforcement that supports compliant authentication information management under Annex A 5.17, but Annex A 5.17 extends well beyond GPP to all credential types and lifecycle processes.

This control is broader than ISM-1953.

ISM-1953 mandates that credentials for the built-in Administrator account in each domain are long, unique, unpredictable and managed. Annex A 5.17 is broader than ISM-1953, requiring an organisational process for allocation and management of authentication information across users and systems, including guidance on appropriate handling. ISM-1953 is a specific, high-risk application of Annex A 5.17's general authentication-information management expectations focused on one critical account type.

This control is broader than ISM-1980.

ISM-1980 requires that credential hint functionality is not used for systems, since hints can disclose or help guess authentication information. This is a specific rule for protecting authentication information within the management process required by Annex A 5.17. Annex A 5.17 covers allocation, resetting and user handling of all authentication information, while ISM-1980 prohibits one feature.

This control is broader than ISM-2011.

ISM-2011 requires a specific rule: if phishing-resistant MFA is used by human users, other non-phishing-resistant MFA options must be disabled for their user accounts. ISO/IEC 27001:2022 Annex A 5.17 requires that allocation and management of authentication information is controlled by a management process, under which permitted MFA methods and the disabling of weak factors would be governed. Annex A 5.17 is broader governance over authentication information generally, while ISM-2011 is a prescriptive hardening requirement targeting MFA downgrade paths.

This control is broader than ISM-2030.

ISM-2030 requires commit-time scanning to prevent passwords, keys and other secrets being committed to the main source repository. Annex A 5.17 requires authentication information to be allocated and managed under a controlled process and that personnel are advised on appropriate handling. ISM-2030 supports Annex A 5.17 by technically enforcing correct handling (preventing repository storage of authentication material), but it does not by itself establish the full management process for authentication information lifecycle and user guidance.

This control is broader than ISM-2044.

ISM-2044 requires software installations to avoid default credentials and to create credentials on first install by the installing organisation. Annex A 5.17 requires a controlled process for allocation and management of authentication information, which includes establishing, issuing and protecting credentials across their lifecycle. Annex A 5.17 is broader because it extends well beyond installation (ongoing management, communication and handling of authentication information), whereas ISM-2044 targets a specific control point: initial credential creation and the elimination of vendor defaults.

This control is broader than ISM-2076.

ISM-2076 prohibits using security questions as an authentication mechanism. ISO/IEC 27001:2022 Annex A 5.17 requires organisations to control the allocation and management of authentication information, which can include defining what forms of authentication information are permitted and how they are handled. Annex A 5.17 is broader and process-focused, whereas ISM-2076 is a specific control decision about excluding security questions from the authentication design.

This control is broader than ISM-2141.

ISM-2141 requires applications and workloads to prefer short-lived, dynamically issued credentials over long-lived static secrets. This relates directly to Annex A 5.17 because managing authentication information includes controlling how credentials are issued, rotated, protected and retired, which can be satisfied by adopting ephemeral, on-demand credentials. Annex A 5.17 is broader, covering all authentication information management (including user guidance and handling processes), whereas ISM-2141 is a specific design choice for non-human credentials in applications/workloads.

This control is broader than ISM-2142.

ISM-2142 requires static credentials used by applications and workloads to be centrally managed via a credential or secrets management solution. This is a specific implementation approach that fits within ISO/IEC 27001:2022 Annex A 5.17, which requires an organisation-wide process for allocating, managing and handling authentication information. Annex A 5.17 is broader because it covers authentication information generally (including for people and multiple credential types), whereas ISM-2142 focuses on central secrets management for application/workload credentials.

This control is broader than ISM-2143.

ISM-2143 requires each application/workload to have unique credentials that are not reused across other applications or across development, test, staging and production environments. ISO/IEC 27001:2022 Annex A 5.17 establishes a broader process for allocating and managing authentication information, within which per-application and per-environment credential uniqueness is a specific rule/standard. Annex A 5.17 covers additional lifecycle and handling requirements (e.g. user guidance and broader authentication information governance) that are not explicitly stated in ISM-2143.

This control is broader than ISM-2144.

ISM-2144 mandates rotating static credentials when compromise is suspected or when they are stored or transmitted in cleartext. ISO/IEC 27001:2022 Annex A 5.17 covers the broader management and allocation of authentication information. ISM-2144 would be a specific part of an Annex A 5.17 process.

This control is broader than ISM-2146.

ISM-2146 requires static credentials used by applications and workloads (e.g. API keys, service account passwords, tokens) to be revoked as soon as they are no longer required. ISO/IEC 27001:2022 Annex A 5.17 establishes a managed process for allocating and controlling authentication information, which includes how credentials are handled across their lifecycle. ISM-2146 is a specific lifecycle action (revocation on end-of-need) within the broader authentication-information management process described by Annex A 5.17.

This control is broader than ISM-2148.

ISM-2148 focuses on terminating active authentication states (sessions/tokens) under specific triggers such as resets, compromise suspicion, device non-compliance, or high-risk sign-ins. Annex A 5.17 governs the allocation and management of authentication information (e.g. passwords, keys, token secrets) via a controlled process, which is commonly where reset and compromise-handling procedures are defined. ISM-2148 is a concrete operational control that can be implemented as part of the broader authentication-information management process in Annex A 5.17.

This control partially overlaps ISM-0383.

Annex A 5.17 requires a controlled process for allocating and managing authentication information, including secure handling expectations for credentials. ISM-0383 relates by requiring default operating system accounts or credentials to be changed, disabled or removed during initial setup, which is a key step in managing authentication information to prevent use of known default credentials. ISM-0383 is focused on initial configuration hardening, while Annex A 5.17 covers ongoing lifecycle management and personnel guidance for all authentication information.

This control partially overlaps ISM-0421.

Annex A 5.17 requires controlled allocation and management of authentication information and guidance to personnel on secure handling. ISM-0421 relates by mandating a minimum password length (15 characters) for single-factor authentication on non-classified, OFFICIAL: Sensitive and PROTECTED systems, which is a concrete password policy rule that would be governed under the Annex A 5.17 process. ISM-0421 is limited to one strength requirement, while Annex A 5.17 is broader across password issuance, storage, reset and secure communication.

This control partially overlaps ISM-0422.

Annex A 5.17 requires controlled management of authentication information, including ensuring personnel know how to handle passwords securely. ISM-0422 relates by setting a minimum password length for single-factor authentication on TOP SECRET systems (20 characters), which is a specific policy requirement that would be implemented and enforced through the Annex A 5.17 management process. ISM-0422 focuses only on password length for a classification level, while Annex A 5.17 includes broader lifecycle controls such as secure distribution, storage and reset processes.

This control partially overlaps ISM-0553.

Annex A 5.17 requires organisations to control the allocation and management of authentication information (e.g., credentials) via a defined process and to instruct personnel on correct handling. ISM-0553 relates by requiring authentication and authorisation for video conferencing actions, which depends on appropriate credential handling. However, ISM-0553 is service-specific.

This control partially overlaps ISM-0555.

ISM-0555 requires authentication and authorisation for all actions on an IP telephony network, including device registration and voicemail access. Annex A 5.17 supports controlled management of authentication information used by IP telephony users and administrators, aligning with ISM-0555's enforcement focus.

This control partially overlaps ISM-1327.

Annex A 5.17 requires management processes for authentication information and guiding personnel on correct handling. ISM-1327 relates by requiring certificate protection for network authentication, a specific class of authentication information.

This control partially overlaps ISM-1402.

ISM-1402 requires organisations to protect stored credentials using password managers, HSMs, or secure hashing methods before storage. ISO/IEC 27001:2022 Annex A 5.17 overlaps by requiring the allocation and management of authentication information to be controlled, including guidance on appropriate handling. Annex A 5.17 is broader in governance and lifecycle of authentication information, whereas ISM-1402 is a specific technical requirement for protecting credentials at rest.

This control partially overlaps ISM-1449.

ISM-1449 requires SSH private keys to be protected with a password or encryption so that possession of the key file alone is insufficient for authentication. ISO/IEC 27001:2022 Annex A 5.17 requires authentication information to be allocated and managed under a controlled process, including guidance on appropriate handling of secrets. They overlap because SSH private key passphrases (and any key-encryption credentials) are a form of authentication information that must be handled securely, but Annex A 5.17 is process-focused and covers many credential types beyond SSH keys.

This control partially overlaps ISM-1557.

Annex A 5.17 requires organisations to manage authentication information via controlled processes and provide guidance on secure handling. ISM-1557 relates by prescribing minimum password length (17 characters) for single-factor authentication on SECRET systems, which is a specific password policy requirement managed under an Annex A 5.17 process. ISM-1557 is limited to a strength parameter for a given classification, while Annex A 5.17 covers broader lifecycle management such as provisioning, secure storage, reset and communication.

This control partially overlaps ISM-1558.

Annex A 5.17 requires controlled processes and user guidance for the secure handling and management of authentication information such as passwords. ISM-1558 relates by providing prescriptive rules for constructing passphrases (e.g. avoiding predictable sources and requiring minimum random word counts), which are specific handling/creation requirements that would sit under an Annex A 5.17 authentication information management process. ISM-1558 is narrowly focused on password composition, while Annex A 5.17 spans the full lifecycle including allocation, distribution, storage and reset.

This control partially overlaps ISM-1559.

Annex A 5.17 requires organisations to control the allocation and management of authentication information and to advise personnel on secure handling. ISM-1559 relates by setting a minimum password length for passwords used for multi-factor authentication on non-classified, OFFICIAL: Sensitive and PROTECTED systems, which is a specific policy parameter to manage password quality. ISM-1559 is limited to one complexity/length metric, while Annex A 5.17 is broader and also includes processes for issuance, storage, reset and communication of handling rules.

This control partially overlaps ISM-1561.

Annex A 5.17 requires a managed process to allocate, manage and guide personnel in the secure handling of authentication information. ISM-1561 relates by prescribing a specific password length requirement for passwords used as part of multi-factor authentication on TOP SECRET systems, which is one concrete rule that would be enforced within such a management process. However, ISM-1561 is a single technical strength parameter, while Annex A 5.17 also covers broader lifecycle controls such as issuance, distribution, storage, reset and user guidance for authentication information.

This control partially overlaps ISM-1593.

ISM-1593 requires human users to provide sufficient evidence of identity before credentials are issued, reset, temporarily disabled, or enrolled/re-enrolled. Annex A 5.17 requires a controlled process for allocating and managing authentication information, which typically includes secure issuance and reset workflows where identity verification is a key step. Annex A 5.17 is broader about end-to-end authentication information management (handling, storage, distribution), while ISM-1593 is narrowly focused on the identity-proofing step at key credential lifecycle events.

This control partially overlaps ISM-1596.

Annex A 5.17 requires a controlled management process for allocating and handling authentication information, including user guidance on proper handling. ISM-1596 relates by requiring users not to reuse credentials across different systems, which is a key handling and usage rule for authentication information that the Annex A 5.17 process would communicate and enforce. ISM-1596 focuses narrowly on reuse behaviour across systems, whereas Annex A 5.17 encompasses wider management activities such as provisioning, resets, secure storage and distribution.

This control partially overlaps ISM-1685.

Annex A 5.17 requires a managed process for allocating and controlling authentication information and advising personnel on secure handling. ISM-1685 relates by mandating that credentials for break glass, local administrator and service accounts are long, unique, unpredictable and managed, which is a specialised instance of strong authentication information management. ISM-1685 is scoped to privileged/critical accounts and credential properties, while Annex A 5.17 is broader and applies across credential lifecycle and all user populations.

This control partially overlaps ISM-1955.

Annex A 5.17 requires organisations to control the allocation and management of authentication information through a defined process, including handling and maintenance of credentials. ISM-1955 relates by requiring computer account credentials to be changed when compromised or suspected compromised, and otherwise within a specified timeframe, which is a concrete lifecycle management activity for authentication information. ISM-1955 is narrowly focused on rotation/change conditions for computer accounts, while Annex A 5.17 is broader and covers issuance, secure storage, distribution and user guidance across all authentication information types.

This control partially overlaps ISM-2047.

Annex A 5.17 requires a managed process for authentication information, including secure handling and communication practices around credential changes. ISM-2047 relates by requiring users to be notified via a secondary channel when an authentication factor is reset, which is a specific control that protects the reset process from silent takeover and improves secure handling of authentication changes. ISM-2047 focuses specifically on reset notifications, while Annex A 5.17 covers broader allocation and management processes across the full credential lifecycle.

This control partially overlaps ISM-2078.

Annex A 5.17 requires controlled management of authentication information and user guidance on appropriate handling of passwords and similar secrets. ISM-2078 relates by requiring passwords not to be commonly used or known-compromised, which is a specific rule for preventing weak or exposed authentication information from being allocated or used. ISM-2078 is focused on password selection validation, while Annex A 5.17 is broader across allocation processes, secure storage, reset and communication practices.

This control partially overlaps ISM-2079.

Annex A 5.17 requires a management process to control authentication information, including communicating appropriate handling requirements to personnel. ISM-2079 relates by requiring password systems not to impose a maximum length limit below 64 characters, which is a technical policy setting that supports secure password handling and reduces forced password truncation risks. ISM-2079 is a specific system configuration requirement, whereas Annex A 5.17 is broader and includes governance and lifecycle management beyond password field constraints.

This control partially overlaps ISM-2080.

ISM-2080 specifies that organisations do not enforce password complexity requirements. Annex A 5.17 requires controlled allocation and management of authentication information, which includes governing password issuance, reset, storage, and user guidance, where complexity rules (or their absence) are part of the managed approach. Annex A 5.17 is broader because it covers the full management lifecycle of authentication information beyond password composition requirements.

This control partially overlaps ISM-2109.

ISM-2109 mandates implementing pre-boot authentication using passwords or managed network-based key release for encrypted system volumes. Annex A 5.17 covers the management and governance of authentication information, such as boot passwords and recovery secrets, for use in pre-boot authentication. This overlaps in the context of handling authentication information, though ISM-2109 specifically focuses on the enforcement at boot time.

This control partially overlaps ISM-2126.

ISM-2126 requires a defined way to authenticate requestors (or use an independent trusted channel) before executing account, banking, or payment requests. ISO/IEC 27001:2022 Annex A 5.17 supports this by requiring controlled allocation and management of authentication information, ensuring the credentials/factors used for positive identification are governed and handled appropriately. Annex A 5.17 focuses on the management lifecycle and handling of authentication information, whereas ISM-2126 focuses on the operational verification step before processing sensitive requests.

This control partially overlaps ISM-2135.

ISM-2135 mandates documenting user accounts and credentials an AI agent uses, alongside identities. Annex A 5.17 requires managing authentication information securely, involving proper handling. They overlap on managing authentication information for non-human actors, with ISM-2135 focused on register completeness and Annex A 5.17 on secure lifecycle management of authentication secrets.

This control partially overlaps ISM-2140.

ISM-2140 requires disabling OAuth device code flow unless required and constraining any permitted use to authorised accounts on managed devices. This overlaps with ISO/IEC 27001:2022 Annex A 5.17 because limiting device code flow reduces exposure and mishandling of authentication information (e.g. user/device codes and resultant tokens) by constraining where and by whom it can be used. Annex A 5.17 is primarily about lifecycle management, allocation and handling guidance for authentication information, whereas ISM-2140 is a specific technical restriction on an authentication pathway rather than credential management procedures.

This control partially overlaps ISM-2145.

ISM-2145 requires organisations to revoke user account credentials as soon as they are no longer required. ISO/IEC 27001:2022 Annex A 5.17 relates by requiring controlled allocation and management of authentication information, which typically includes processes for withdrawal/invalidating credentials when users change roles or leave. Annex A 5.17 is broader across the authentication information lifecycle (issuance, handling, protection), whereas ISM-2145 is specifically focused on timely revocation at end-of-need.

This control supports ISM-1401.

ISM-1401 requires multi-factor authentication to be implemented using specific factors (possession with knowledge or inherence), which relies on proper handling of credentials and authenticators. Annex A 5.17 requires controlled allocation and management of authentication information, which is necessary to securely issue, protect, reset, and revoke the knowledge factors (e.g. PINs/passwords) and manage associated authenticators used in ISM-1401 MFA. ISM-1401 defines the factor model, while Annex A 5.17 provides the governance needed to operate those factors securely.

This control supports ISM-2136.

ISM-2136 requires enforcing risk-based access decisions that may step up authentication or deny access based on contextual risk. Annex A 5.17 requires controlled allocation and management of authentication information (e.g. credentials and secrets) through a defined process. ISM-2136 relies on strong, well-managed authentication information to ensure that any risk-based decisions (including step-up challenges) are meaningful and resistant to credential compromise, but Annex A 5.17 does not address contextual signal-driven decisioning.

This control depends on ISM-0974.

ISM-0974 requires MFA for unprivileged human users of systems, which relies on managing authenticators such as tokens, device-bound keys, or OTP seeds. ISO/IEC 27001:2022 Annex A 5.17 addresses the controlled allocation and management of authentication information and user handling guidance, supporting the secure operation of MFA required by ISM-0974. ISM-0974 mandates using MFA, while Annex A 5.17 governs how the underlying authentication information is issued, protected, and managed.

This control depends on ISM-1324.

ISM-1324 requires certificates to be generated using an evaluated certificate authority or hardware security module to ensure authentication credentials are trustworthy and protected. This supports Annex A 5.17 by strengthening the secure allocation and management of authentication information when that information includes certificates and associated keys. Annex A 5.17 is broader and process-oriented (covering management and handling of authentication information generally), while ISM-1324 is a technical control focused on certificate issuance tooling and assurance.

This control depends on ISM-1615.

ISM-1615 requires organisations to test break glass accounts after changing their credentials to verify the updated authentication information works operationally. This supports Annex A 5.17 because it strengthens the management process for authentication information by adding an assurance check for a high-impact credential lifecycle event (credential change) on emergency accounts. Annex A 5.17 is broader, covering allocation, handling and management rules for authentication information generally, while ISM-1615 is specifically about post-change functional testing rather than how credentials are issued or protected.

This control depends on ISM-1679.

ISM-1679 requires MFA for human users accessing third-party online services that handle sensitive organisational data. ISO/IEC 27001:2022 Annex A 5.17 focuses on controlling the allocation and management of authentication information (e.g., enrolment, distribution, handling and user guidance). Annex A 5.17 supports ISM-1679 by ensuring MFA credentials and related authentication information are securely issued and managed, but it does not itself mandate MFA for third-party services.

This control is broader than IT.PRO-13.2.

IT.PRO-13.2 requires authentication keys, secrets and tokens to be stored in approved secure repositories protected by access controls, including MFA. This is a specific implementation of the controlled management of authentication information required by Annex A 5.17, addressing how that information is securely held. Annex A 5.17 is broader, also covering how authentication information is allocated and how personnel are advised to handle it.

This control is broader than IT.PRO-13.3.

IT.PRO-13.3 requires regular scanning of codebases, configuration files, file shares and user collaboration platforms to identify and remediate unsecured keys, secrets and credentials. This supports the management process for authentication information in Annex A 5.17 by finding credentials that have been handled or stored insecurely and correcting that exposure. Annex A 5.17 is a management process that also covers allocation and advice to personnel, whereas IT.PRO-13.3 is a specific technical check on how credentials are actually held.

This control is broader than IT.PRO-13.6.

IT.PRO-13.6 requires user, machine, system and service account credentials to be unique per system or account, particularly in high-privilege contexts. This is a specific rule within the controlled allocation and management of authentication information required by Annex A 5.17. Annex A 5.17 is broader, covering the whole management process for authentication information, including advising personnel on its appropriate handling.