ISO 27001 Annex A 8.5 Secure authentication technologies and procedures
What it says
Secure authentication technologies and procedures shall be implemented based on information access restrictions and the topic-specific policy on access control.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUse secure methods to confirm identities and control access to systems and data.
This control is about making sure that only the right people can access your important systems and data. If you don't secure how people log in, you might let in someone who shouldn't be there, which could lead to sensitive information being stolen or damaged.
Free. Save your status, tasks and notes.
Why it matters
Weak or poorly implemented authentication (e.g., no MFA) enables account takeover and unauthorised access to restricted information, causing breaches, fraud and financial loss.
How to implement
The IT manager should review current authentication methods.
They need to ensure strong security measures like using digital certificates or biometrics rather than relying on passwords alone. This improves security according to ISO 27002:2022 guidance by matching authentication strength to information sensitivity.
Human Resources should update policies to require multi-factor authentication for critical systems.
This involves using more than one type of proof, such as a password and a code on your phone, especially for accessing vital information systems. It aligns with the Australian Privacy Act 1988, which stresses protecting personal information.
Procurement should ensure that any new systems purchased support various secure authentication methods.
They need to include digital tokens or smart cards in procurement specifications, ensuring systems are adaptable to future security requirements under CPS 234.
The Board should mandate regular audits of authentication procedures.
This requires appointing an internal or external auditor to check that the procedures meet current standards and best practices, ensuring organisational compliance and risk management align with ISO 27001.
The IT Security Team should implement log-on procedures that protect against unauthorised access, as recommended in ISO 27002:2022.
This involves using CAPTCHA to prevent automated access, setting up alerts for failed login attempts, and ensuring systems log these attempts for review.
Keep it running
Quarterly verify MFA, password/SSO settings and admin access meet access restrictions; test login controls, monitor failed logins and remediate weaknesses.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
To see the organisation's authentication policy.
Look at
Whether it specifies using secure methods like multi-factor authentication.
Good evidence
A policy that includes multiple layers of authentication for high-risk areas.
- Check 2 of 5What an auditor asks for
Ask for
A demonstration of the logon process for critical systems.
Look at
How the system handles incorrect login attempts and if it requires extra verification steps.
Good evidence
A system that locks out users after multiple failed attempts and alerts administrators.
- Check 3 of 5What an auditor asks for
Ask for
Logs of login attempts for the past 3 months.
Look at
Entries indicating both successful and unsuccessful attempts.
Good evidence
Detailed logs showing systems alert appropriate personnel of repeated failed attempts.
- Check 4 of 5What an auditor asks for
Ask for
User feedback on the authentication process.
Look at
Concerns raised about ease of use versus security.
Good evidence
Feedback showing employees can complete secure logins without unnecessary complications.
- Check 5 of 5What an auditor asks for
Ask for
To see records of system access reviews.
Look at
How often these reviews take place and what actions are taken on findings.
Good evidence
Regular, documented reviews with actions taken to improve security posture.
Mappings
Closest match in ASD Essential Eight: E8-MF-ML1.1, Require multi-factor authentication for sensitive online services, which this control covers in full and more.
ASD Essential Eight: 14 mappings
This control is broader than E8-MF-ML1.1.
E8-MF-ML1.1 requires MFA for authentication to sensitive online services. ISO/IEC 27001:2022 Annex A 8.5 relates by requiring secure authentication technologies and procedures based on access restrictions, under which MFA for higher-risk/sensitive access is a common and appropriate control. Annex A 8.5 is broader and less prescriptive (covering all authentication methods and procedures), while E8-MF-ML1.1 is a specific requirement mandating MFA for a defined scope of services and data.
This control is broader than E8-MF-ML1.2.
E8-MF-ML1.2 requires MFA for authenticating users to third-party services handling sensitive data. ISO/IEC 27001:2022 Annex A 8.5 requires implementing secure authentication procedures commensurate with access restrictions and access control policy, which can include MFA. E8-MF-ML1.2 is a specific prescriptive instance within the broader authentication expectations of Annex A 8.5.
This control is broader than E8-MF-ML1.3.
E8-MF-ML1.3 requires the use of MFA (where available) for user authentication to third-party online services handling non-sensitive organisational data. ISO/IEC 27001:2022 Annex A 8.5 requires secure authentication technologies and procedures to be implemented based on access restrictions and access control policy, which can include MFA but is not limited to it. E8-MF-ML1.3 is a specific MFA application scenario within the broader authentication control set of Annex A 8.5.
This control is broader than E8-MF-ML1.4.
E8-MF-ML1.4 requires MFA for users authenticating to online customer services that handle sensitive customer data. ISO/IEC 27001:2022 Annex A 8.5 is broader, requiring secure authentication technologies and procedures based on access restrictions and policy, which may include MFA among other mechanisms. E8-MF-ML1.4 is a specific prescriptive authentication requirement within the wider authentication control framework described by Annex A 8.5.
- E8-MF-ML1.6Multi-factor authentication for customer access to online services handling sensitive dataBroader than
This control is broader than E8-MF-ML1.6.
E8-MF-ML1.6 requires MFA for customers authenticating to online customer services handling sensitive customer data. ISO/IEC 27001:2022 Annex A 8.5 broadly requires secure authentication technologies and procedures based on access restrictions and access control policy, and can include MFA among other mechanisms. E8-MF-ML1.6 is a specific prescriptive authentication control that fits within the broader expectations of Annex A 8.5.
This control is broader than E8-MF-ML1.7.
E8-MF-ML1.7 mandates a specific secure authentication approach by defining MFA factor combinations (possession plus knowledge/biometrics). ISO/IEC 27001:2022 Annex A 8.5 requires organisations to implement secure authentication technologies and procedures based on access restrictions and access control policy, which can include MFA among other mechanisms. E8-MF-ML1.7 is narrower because it focuses specifically on MFA composition, whereas Annex A 8.5 is broader across authentication methods and procedures.
This control is broader than E8-MF-ML2.1.
E8-MF-ML2.1 requires MFA for privileged users accessing systems. ISO/IEC 27001:2022 Annex A 8.5 requires secure authentication technologies and procedures to be implemented based on access restrictions and policy, which can include MFA but is not limited to it. E8-MF-ML2.1 is a specific instantiation of the broader authentication control in Annex A 8.5 focused on privileged authentication strength.
This control is broader than E8-MF-ML2.2.
E8-MF-ML2.2 specifically requires MFA for unprivileged users accessing systems. ISO/IEC 27001:2022 Annex A 8.5 requires secure authentication technologies and procedures based on access restrictions and access control policy, which can include MFA but is not limited to it. E8-MF-ML2.2 is therefore a specific implementation example within the broader authentication control in Annex A 8.5.
This control is broader than E8-MF-ML2.3.
E8-MF-ML2.3 requires a specific authentication outcome: MFA for online services must be phishing-resistant. ISO/IEC 27001:2022 Annex A 8.5 is broader, requiring secure authentication technologies and procedures based on access restrictions and access control policy, which can include MFA and anti-phishing measures. E8-MF-ML2.3 is a specific implementation expectation that fits within the broader secure authentication practices required by Annex A 8.5.
- E8-MF-ML2.4Offer customers a phishing-resistant multi-factor authentication option for online customer servicesBroader than
This control is broader than E8-MF-ML2.4.
E8-MF-ML2.4 requires that multi-factor authentication for customers of online customer services offers a phishing-resistant option, while Annex A 8.5 requires secure authentication technologies and procedures to be implemented in line with access restrictions and the access control policy. Offering phishing-resistant authentication to customers is one specific secure authentication measure that contributes to meeting Annex A 8.5.
This control is broader than E8-MF-ML2.5.
E8-MF-ML2.5 requires phishing-resistant MFA for system access as a specific secure authentication outcome. ISO/IEC 27001:2022 Annex A 8.5 requires secure authentication technologies and procedures generally, based on access restrictions and policy. E8-MF-ML2.5 is a specific, higher-prescription subset of Annex A 8.5 focused on phishing-resistant MFA for system authentication.
- E8-MF-ML3.1Multi-factor authentication is used to authenticate users of data repositoriesBroader than
This control is broader than E8-MF-ML3.1.
Annex A 8.5 requires organisations to implement secure authentication technologies and procedures aligned with access restrictions and the access control policy. E8-MF-ML3.1 specifically mandates multi-factor authentication (MFA) for users of data repositories, which is one specific method within the broader requirement of Annex A 8.5 that also covers other authentication forms and procedural controls beyond MFA and beyond data repositories.
This control is broader than E8-MF-ML3.2.
Annex A 8.5 requires the implementation of secure authentication technologies suitable to access restrictions. E8-MF-ML3.2 enforces this by requiring phishing-resistant multi-factor authentication for online customer service access, focusing on customer identity assurance which is a narrower application of Annex A 8.5's broader and technology-neutral mandate.
This control is broader than E8-MF-ML3.3.
E8-MF-ML3.3 requires a specific control: phishing-resistant MFA for users of data repositories. ISO/IEC 27001:2022 Annex A 8.5 broadly requires secure authentication technologies and procedures based on access restrictions and access control policy, which can include MFA choices and anti-phishing measures. E8-MF-ML3.3 is a specific implementation case under the broader secure authentication expectations of Annex A 8.5.
ASD Information Security Manual: 66 mappings
This control is broader than ISM-0417.
ISM-0417 specifies a particular authentication fallback: if MFA is not supported, use passwords for single-factor authentication. This overlaps with Annex A 8.5 because it requires implementing secure authentication technologies and procedures appropriate to access restrictions, which can include password-based authentication where MFA is infeasible. Annex A 8.5 is broader and risk-based, covering selection and implementation of authentication mechanisms generally (including MFA and other secure methods), whereas ISM-0417 is a specific conditional requirement.
This control is broader than ISM-0421.
ISM-0421 mandates a minimum 15-character password length for single-factor authentication on non-classified, OFFICIAL: Sensitive and PROTECTED systems. ISO/IEC 27001:2022 Annex A 8.5 requires implementing secure authentication technologies and procedures aligned to access restrictions, which can include strong password controls as one authentication procedure. ISM-0421 is one concrete authentication hardening measure that would support compliance with the broader, risk- and policy-driven requirements in Annex A 8.5.
This control is broader than ISM-0428.
ISM-0428 requires re-authentication using all authentication factors to unlock a locked session, and prevents users from disabling the locking mechanism. This supports Annex A 8.5 by operationalising secure authentication procedures at the point of session unlock, ensuring authentication strength is maintained throughout the session lifecycle. Annex A 8.5 is broader (covering authentication technologies and procedures generally), whereas ISM-0428 is a specific use-case applying authentication controls to session re-entry.
This control is broader than ISM-0485.
ISM-0485 requires the use of public key authentication specifically for SSH access to harden remote administration and system access paths. Annex A 8.5 requires implementing secure authentication technologies and procedures more generally, based on access restrictions and access control policy. ISM-0485 fits within Annex A 8.5 as a concrete secure-authentication mechanism for one protocol, while Annex A 8.5 applies across all systems, services, and authentication methods.
This control is broader than ISM-0488.
ISM-0488 addresses secure use of SSH authentication without passwords by constraining authorised SSH key usage to a forced command and checking parameters. Annex A 8.5 requires secure authentication technologies and procedures based on access restrictions, which inherently includes safely-scoped authentication mechanisms for remote administration. Both controls aim for secure authentication, but Annex A 8.5 is broader across different methods and procedures while ISM-0488 specifies key-based SSH access.
This control is broader than ISM-0551.
ISM-0551 requires IP telephony to enforce secure device registration by having IP phones authenticate to the call controller, disabling auto-registration, blocking unauthorised devices by default, and disabling unused/prohibited functions. This aligns with Annex A 8.5 which requires implementing secure authentication technologies and procedures appropriate to access restrictions. ISM-0551 is a technology-specific instantiation (IP phone-to-call-controller authentication and admission control) of the broader authentication requirement in Annex A 8.5.
This control is broader than ISM-0554.
ISM-0554 requires an encrypted and non-replayable two-way authentication scheme specifically for video call authentication and authorisation. ISO/IEC 27001:2022 Annex A 8.5 requires secure authentication technologies and procedures to be implemented more generally, based on access restrictions and access control policy. ISM-0554 is a concrete, use-case-specific application of secure authentication, adding explicit anti-replay and call-session context that Annex A 8.5 does not spell out.
This control is broader than ISM-0590.
ISM-0590 requires that authentication measures on multi-function devices (MFDs) are as strong as those used for workstations on the connected networks. ISO/IEC 27001:2022 Annex A 8.5 requires implementing secure authentication technologies and procedures based on access restrictions and access control policy, which would include devices such as MFDs where they provide system access. ISM-0590 is a device-specific strength-alignment requirement, whereas Annex A 8.5 is broader and applies to authentication across the organisation's systems and services.
This control is broader than ISM-0619.
ISM-0619 requires users to authenticate to other networks accessed via gateways. ISO/IEC 27001:2022 Annex A 8.5 requires secure authentication based on access restrictions, including at gateways. Annex A 8.5 is broader, covering policy-driven secure authentication technologies in various contexts, while ISM-0619 specifies gateway access scenarios.
This control is broader than ISM-0622.
ISM-0622 requires IT equipment to authenticate when accessing other networks via gateways, addressing authentication at network boundaries. Annex A 8.5 requires implementing secure authentication technologies and procedures based on access restrictions, which can include device authentication mechanisms (e.g. 802.1X, mutual TLS, VPN client certificates) used at gateways and network access points. Annex A 8.5 is broader because it applies to authentication generally (users, devices and systems) across many access scenarios, not specifically gateway-mediated network access.
This control is broader than ISM-0974.
ISM-0974 requires MFA for unprivileged users accessing systems as a specific authentication mechanism. ISO/IEC 27001:2022 Annex A 8.5 mandates secure authentication technologies, which can include MFA among other methods. ISM-0974 is a more specific instance of the broader secure authentication requirement.
This control is broader than ISM-1014.
ISM-1014 requires individual logins for secure use of IP phones for SECRET or TOP SECRET conversations, implying a need for robust user authentication and traceability. Annex A 8.5 requires secure authentication technologies and procedures to be implemented based on access restrictions, which provides the general requirement that would encompass authenticating users to an IP phone service. ISM-1014 is a specific instantiation for classified voice endpoints, whereas Annex A 8.5 is broader and technology-agnostic about the authentication method and systems covered.
This control is broader than ISM-1055.
ISM-1055 requires organisations to disable insecure legacy authentication protocols (LAN Manager and NTLM variants) to reduce credential compromise risk. Annex A 8.5 requires implementing secure authentication technologies and procedures appropriate to access restrictions, which would typically include prohibiting weak legacy authentication methods. Annex A 8.5 is broader and technology-agnostic (covering authentication approaches generally), while ISM-1055 is a specific hardening requirement for Windows/SMB authentication.
This control is broader than ISM-1151.
ISM-1151 requires organisations to verify the authenticity of incoming emails using SPF to reduce spoofing and impersonation risk. This relates to ISO/IEC 27001:2022 Annex A 8.5 because SPF is a specific authentication technology/procedure applied to an information flow (email) to validate a claimed identity (sending domain). Annex A 8.5 is broader because it covers secure authentication technologies and procedures across access control contexts, whereas ISM-1151 is limited to email origin validation via SPF.
This control is broader than ISM-1173.
ISM-1173 requires MFA specifically for privileged users of systems. ISO/IEC 27001:2022 Annex A 8.5 requires secure authentication technologies and procedures to be implemented based on access restrictions, which can include MFA and covers all users and authentication scenarios. ISM-1173 is therefore a specific implementation subset of the broader authentication control in Annex A 8.5.
This control is broader than ISM-1321.
ISM-1321 requires 802.1X authentication using EAP-TLS with X.509 certificates for mutual authentication on wireless networks, and disabling all other EAP methods on supplicants and authentication servers. ISO/IEC 27001:2022 Annex A 8.5 requires secure authentication technologies and procedures to be implemented based on access restrictions and access control policy, which includes selecting strong mechanisms such as certificate-based authentication where appropriate. ISM-1321 is a prescriptive, technology-specific instantiation of the broader Annex A 8.5 requirement.
- ISM-1322Using evaluated supplicants, authenticators and authentication servers for 802.1XBroader than
This control is broader than ISM-1322.
ISM-1322 requires organisations to use evaluated 802.1X components (supplicants, authenticators, wireless access points and authentication servers) to secure wireless network authentication. This relates to Annex A 8.5, which requires secure authentication technologies and procedures to be implemented in line with access restrictions and access control policy. ISM-1322 is a specific, technology-focused instantiation (802.1X and evaluated components for WLAN) whereas Annex A 8.5 is broader and applies to authentication across systems and use cases beyond wireless.
This control is broader than ISM-1323.
ISM-1323 requires the use of X.509 certificates for both device and human user authentication when joining networks via 802.1X. This is a specific instance of implementing secure authentication technologies and procedures as required by Annex A 8.5, particularly for network access authentication. Annex A 8.5 is broader and technology-agnostic (it could be satisfied with various strong authentication mechanisms), whereas ISM-1323 mandates a particular control pattern (certificate-based 802.1X).
This control is broader than ISM-1330.
ISM-1330 mandates a concrete control on wireless authentication by limiting PMK caching to 24 hours to constrain reuse of derived keying material. This partially aligns with Annex A 8.5 because PMK caching is an aspect of secure authentication technologies and procedures on wireless networks. Annex A 8.5 is higher-level and covers many authentication mechanisms beyond Wi‑Fi key caching, whereas ISM-1330 is a specific parameter setting for one authentication context.
This control is broader than ISM-1504.
ISM-1504 requires MFA for authenticating users to the organisation's online services that process, store or communicate sensitive data. ISO/IEC 27001:2022 Annex A 8.5 requires implementing secure authentication technologies and procedures more generally, based on access restrictions and access control policy, which can include MFA among other mechanisms. ISM-1504 is a specific prescriptive instance (MFA for sensitive online services) within the broader authentication-control expectations of Annex A 8.5.
This control is broader than ISM-1505.
ISM-1505 requires MFA to be used to authenticate users of data repositories. ISO/IEC 27001:2022 Annex A 8.5 requires secure authentication technologies and procedures based on access restrictions and access control policy, which can include MFA among other methods across many systems and use cases. ISM-1505 is therefore a specific implementation instance within the broader secure-authentication requirement of Annex A 8.5.
This control is broader than ISM-1546.
ISM-1546 requires users to be authenticated before they are granted access to a system and its resources. ISO/IEC 27001:2022 Annex A 8.5 requires implementing secure authentication technologies and procedures aligned to access restrictions and access control policy, which includes authenticating users before access. Annex A 8.5 is broader because it also covers the selection and security of authentication methods and procedures.
This control is broader than ISM-1558.
ISM-1558 requires secure construction of passwords for single-factor authentication, including bans on predictable phrases and minimum random-word lengths by system classification. This relates to Annex A 8.5 because secure password/passphrase construction is one specific authentication procedure that supports secure authentication technologies and processes. Annex A 8.5 is broader, encompassing multiple authentication methods (e.g. MFA, tokens, certificates) and procedural controls beyond password composition alone.
This control is broader than ISM-1559.
ISM-1559 mandates a specific minimum password length (at least 6 characters) when passwords are used as part of multi-factor authentication for non-classified, OFFICIAL: Sensitive and PROTECTED systems. Annex A 8.5 requires organisations to implement secure authentication technologies and procedures in line with access restrictions and access control policy, which can include setting appropriate password/PIN parameters where knowledge factors are used. ISM-1559 is a narrowly defined, measurable parameter for one aspect of authentication strength, whereas Annex A 8.5 is broader and covers authentication mechanisms and procedures more generally without prescribing a length threshold.
This control is broader than ISM-1560.
ISM-1560 sets a concrete authentication-strength requirement by mandating a minimum password length (8 characters) when passwords are used for MFA on SECRET systems. Annex A 8.5 requires implementing secure authentication technologies and procedures in line with access restrictions and access control policy, which would typically include specifying credential strength requirements. Annex A 8.5 is broader and risk-based, while ISM-1560 is a prescriptive, classification-specific parameter that can be used to satisfy part of Annex A 8.5.
This control is broader than ISM-1597.
ISM-1597 requires credentials to be obscured as they are entered into systems, preventing them from being observed on screen during authentication. This is a specific feature of a secure log-on procedure and directly contributes to Annex A 8.5, which requires secure authentication technologies and procedures to be implemented. Annex A 8.5 covers authentication design broadly, while ISM-1597 addresses only how credentials are displayed during entry.
This control is broader than ISM-1603.
ISM-1603 requires authentication methods that are susceptible to replay attacks to be disabled. This relates to Annex A 8.5 because implementing secure authentication technologies and procedures typically includes selecting protocols and mechanisms that resist replay (and deprecating insecure ones). Annex A 8.5 is broader as it covers authentication security generally (technology selection and procedural controls), not specifically the disabling of replay-vulnerable methods.
This control is broader than ISM-1679.
ISM-1679 specifically requires MFA for users authenticating to third-party online services that process, store, or communicate the organisation's sensitive data. ISO/IEC 27001:2022 Annex A 8.5 requires implementing secure authentication technologies and procedures more generally, based on access restrictions and access control policy. ISM-1679 is a specific instantiation of secure authentication (MFA) for a defined scenario (third-party services handling sensitive data), so it is narrower than Annex A 8.5.
- ISM-1680Multi-factor authentication for human users of third-party services holding non-sensitive dataBroader than
This control is broader than ISM-1680.
ISM-1680 requires the specific use of multi-factor authentication (where available) for users accessing third-party online services handling an organisation's non-sensitive data. ISO/IEC 27001:2022 Annex A 8.5 requires implementing secure authentication technologies and procedures based on access restrictions and access control policy, which can include MFA among other mechanisms. ISM-1680 is therefore a specific, prescriptive instance of the broader secure authentication expectation in Annex A 8.5.
This control is broader than ISM-1681.
ISM-1681 requires MFA for customers authenticating to online customer services that handle sensitive customer data. ISO/IEC 27001:2022 Annex A 8.5 requires secure authentication technologies and procedures based on access restrictions and access control policy, which can include MFA but is not limited to it. ISM-1681 is a specific prescriptive instance of the broader authentication control in Annex A 8.5.
This control is broader than ISM-1682.
ISM-1682 requires a specific secure authentication outcome: MFA used for system authentication is phishing-resistant. ISO/IEC 27001:2022 Annex A 8.5 requires secure authentication technologies and procedures based on access restrictions and access control policy, which can include (but is not limited to) phishing-resistant MFA. ISM-1682 is a specific, stronger implementation choice within the broader authentication control required by Annex A 8.5.
This control is broader than ISM-1711.
ISM-1711 requires that user identity confidentiality features are used where available in EAP-TLS implementations to prevent exposure of user identifiers during network authentication. Annex A 8.5 requires implementing secure authentication technologies and procedures appropriate to access restrictions, which would include selecting and configuring EAP-TLS securely where it is used. ISM-1711 is a specific technical configuration requirement for one authentication method, while Annex A 8.5 is broader across authentication methods and procedures.
This control is broader than ISM-1749.
ISM-1749 requires cached credentials to be limited to one previous logon, reducing the credential material stored on a device that an attacker could extract or use offline. This is a specific secure authentication configuration that forms part of the secure authentication technologies and procedures Annex A 8.5 requires. Annex A 8.5 covers authentication design and log-on procedures across all systems, while ISM-1749 addresses only the caching of logon credentials.
This control is broader than ISM-1817.
ISM-1817 requires authentication and authorisation of clients when they call internet-accessible APIs that provide access to non-public data. Annex A 8.5 requires implementing secure authentication technologies and procedures based on access restrictions, which applies across systems and interfaces, including APIs. ISM-1817 is a specific application of Annex A 8.5 to the API context and additionally calls out authorisation decisions for API clients.
This control is broader than ISM-1818.
ISM-1818 requires authentication and authorisation of clients when they call internet-accessible network APIs that can modify data. ISO/IEC 27001:2022 Annex A 8.5 relates by requiring secure authentication technologies and procedures aligned to access restrictions, which is a broader requirement that would encompass robust authentication for API clients. ISM-1818 is more specific in scope (API calls over the internet and modification operations) and explicitly includes authorisation, whereas Annex A 8.5 is a general secure-authentication control not limited to APIs.
This control is broader than ISM-1836.
ISM-1836 requires Kerberos pre-authentication to be enforced for user accounts to strengthen authentication and prevent certain Kerberos-based attacks. This relates directly to Annex A 8.5, which requires implementing secure authentication technologies and procedures appropriate to access restrictions. ISM-1836 is a specific technical safeguard within the broader ISO requirement to select and implement secure authentication mechanisms.
This control is broader than ISM-1854.
ISM-1854 requires users to authenticate to multifunction devices (MFDs) before they can print, scan or copy documents. Annex A 8.5 requires an organisation to implement secure authentication technologies and procedures based on access restrictions and the access control policy, which would include authenticating users to shared devices such as MFDs where they provide access to information processing. ISM-1854 is a specific, device-level instance of the broader authentication control in Annex A 8.5, and does not on its own address authentication across all systems and services.
- ISM-1872Phishing-resistant multi-factor authentication for human users of online servicesBroader than
This control is broader than ISM-1872.
Annex A 8.5 requires organisations to implement secure authentication technologies and procedures consistent with access restrictions and access control policy. ISM-1872 requires MFA used for online services to be phishing-resistant, which is a specific control objective for authentication assurance. Annex A 8.5 is broader as it includes wider authentication methods and procedural controls beyond phishing-resistant MFA for online services.
This control is broader than ISM-1874.
ISM-1874 requires a specific secure authentication outcome: phishing-resistant MFA for customers of online customer services. ISO/IEC 27001:2022 Annex A 8.5 requires implementing secure authentication technologies and procedures based on access restrictions and access control policy, which can include MFA and phishing-resistant methods. ISM-1874 is a concrete, customer-facing instantiation of the broader secure authentication requirement in Annex A 8.5.
This control is broader than ISM-1892.
ISM-1892 requires implementing MFA for organisation users of online customer services that handle sensitive customer data. ISO/IEC 27001:2022 Annex A 8.5 requires secure authentication technologies and procedures based on access restrictions and access control policy, which can include MFA as a secure authentication mechanism. ISM-1892 is a specific prescriptive requirement (MFA for a defined service/data context), whereas Annex A 8.5 is broader and risk/policy-driven across authentication methods and contexts.
- ISM-1893Multi-factor authentication for third-party services holding sensitive customer dataBroader than
This control is broader than ISM-1893.
ISM-1893 requires MFA for a specific authentication scenario: users accessing third-party online customer services handling the organisation's sensitive customer data. ISO/IEC 27001:2022 Annex A 8.5 requires implementation of secure authentication technologies and procedures based on access restrictions and access control policy, which can include MFA across many systems and contexts. ISM-1893 is a prescriptive, scoped instance of the broader authentication control intent in Annex A 8.5.
- ISM-1894Phishing-resistant multi-factor authentication for human users of data repositoriesBroader than
This control is broader than ISM-1894.
ISM-1894 requires a specific outcome: MFA used for authenticating users of data repositories must be phishing-resistant. ISO/IEC 27001:2022 Annex A 8.5 requires implementing secure authentication technologies and procedures based on access restrictions and access control policy, which is a broader authentication control. ISM-1894 is a specific prescriptive requirement that fits within the broader expectations of Annex A 8.5 for strong, appropriate authentication.
- ISM-1919Disable authentication protocols that cannot support multi-factor authenticationBroader than
This control is broader than ISM-1919.
ISM-1919 mandates disabling non-MFA-capable protocols for online services when MFA is implemented, specifically preventing legacy access routes. Annex A 8.5 requires implementing secure authentication technologies, which includes encouraging MFA-capable protocol use, hence broader in scope.
This control is broader than ISM-1920.
ISM-1920 requires that users are prevented from self-enrolling MFA from untrustworthy devices when authenticating to online services, systems or data repositories handling sensitive organisational or customer data. Annex A 8.5 requires organisations to implement secure authentication technologies and procedures based on access restrictions and access control policy, which can include controlling MFA enrolment workflows and enforcing device-based conditions. ISM-1920 is a specific procedural/technical restriction (blocking self-enrolment on untrusted devices), while Annex A 8.5 is broader and does not explicitly mandate this particular enrolment constraint.
This control is broader than ISM-1929.
ISM-1929 requires enabling LDAP signing on AD DS domain controllers to ensure integrity of authentication-related directory communications. ISO/IEC 27001:2022 Annex A 8.5 requires secure authentication technologies and procedures, which can include ensuring authentication protocols (such as LDAP binds and directory queries used during logon) are protected against manipulation. ISM-1929 is a concrete configuration for LDAP integrity, while Annex A 8.5 covers a wider set of authentication methods, processes, and controls.
This control is broader than ISM-1943.
ISM-1943 requires strong, enforced mapping between X.509 certificates and user identities within Active Directory services so certificate-based authentication/authorisation is correctly bound to the right account. Annex A 8.5 requires implementing secure authentication technologies and procedures based on access restrictions, which can include certificate-based authentication and identity binding. ISM-1943 is a specific technical control for AD certificate-to-user mapping, while Annex A 8.5 is broader and technology-agnostic across authentication methods.
This control is broader than ISM-1947.
ISM-1947 requires organisations to remove Extended Key Usages (EKUs) in certificates that enable user authentication, ensuring certificates cannot be (mis)used for interactive logon or user authentication pathways. Annex A 8.5 requires organisations to implement secure authentication technologies and procedures aligned to access restrictions, which includes selecting, configuring and hardening authentication mechanisms (including certificate-based authentication) to reduce misuse. ISM-1947 is a single, prescriptive technical hardening measure that would typically sit underneath an Annex A 8.5 secure-authentication design and configuration standard, but Annex A 8.5 also covers many other authentication methods and procedural requirements beyond EKU configuration.
This control is broader than ISM-1980.
ISM-1980 requires that credential hint functionality is not used for systems. Avoiding log-on aids that could help an unauthorised user is part of implementing secure authentication technologies and procedures under Annex A 8.5. Annex A 8.5 covers the full design of secure authentication, whereas ISM-1980 removes one insecure feature.
This control is broader than ISM-2011.
ISM-2011 requires disabling non-phishing-resistant MFA options when phishing-resistant MFA is used, specifically to prevent fallback authentication being exploited. ISO/IEC 27001:2022 Annex A 8.5 requires secure authentication technologies and procedures to be implemented based on access restrictions and access control policy, which would include selecting phishing-resistant MFA and preventing insecure fallback mechanisms. Annex A 8.5 is broader across authentication technologies and procedures, whereas ISM-2011 is a narrowly defined configuration requirement about disabling weaker MFA options on an account.
This control is broader than ISM-2013.
Annex A 8.5 mandates secure authentication mechanisms to enforce access control. ISM-2013 implements this within internal network APIs by requiring client authentication and authorisation for API interactions capable of modifying data, illustrating a specific application of the broader Annex A 8.5 requirement to API security.
This control is broader than ISM-2014.
ISM-2014 requires authentication and authorisation of clients when they call internal (non-internet) network APIs that provide access to data not authorised for public release. ISO/IEC 27001:2022 Annex A 8.5 requires secure authentication technologies and procedures to be implemented based on access restrictions, which directly covers the authentication aspect needed for API clients. Annex A 8.5 is broader (all authentication contexts), while ISM-2014 is a specific application to API client access and also explicitly includes authorisation checks.
This control is broader than ISM-2047.
Annex A 8.5 requires secure authentication procedures, including protecting credential lifecycle events like resets. ISM-2047 mandates user notification through a secondary channel for factor reset events, reducing covert account takeover risk. ISM-2047 is a specific procedural safeguard within the broader control intent of Annex A 8.5, which encompasses various secure authentication practices.
This control is broader than ISM-2076.
ISM-2076 requires that security questions are not used for authentication purposes. ISO/IEC 27001:2022 Annex A 8.5 requires secure authentication technologies and procedures to be implemented based on access restrictions and access control policy, which would typically include disallowing weak authenticators such as security questions. Annex A 8.5 is broader because it covers selection and implementation of authentication methods generally, while ISM-2076 is a specific prohibition of one method.
This control is broader than ISM-2077.
ISM-2077 requires that email is not used for out-of-band authentication purposes. This is a specific application of secure authentication design covered by Annex A 8.5, which requires implementing secure authentication technologies appropriate to access restrictions. Annex A 8.5 is broader because it covers the overall operation of authentication mechanisms, whereas ISM-2077 focuses narrowly on excluding email as an out-of-band method.
This control is broader than ISM-2081.
ISM-2081 requires systems to accept all ASCII printable characters in passwords to avoid reducing entropy through unnecessary constraints. Annex A 8.5 requires secure authentication technologies and procedures, which typically includes configuring password mechanisms and authentication controls to meet security policy. ISM-2081 is a specific configuration requirement that fits under the broader umbrella of secure authentication design and implementation in Annex A 8.5.
This control is broader than ISM-2109.
ISM-2109 mandates pre-boot authentication (password or managed network key release) for devices with encrypted system volumes before the operating system boots. ISO/IEC 27001:2022 Annex A 8.5 requires implementation of secure authentication technologies and procedures, which can encapsulate boot-time authentication for encrypted endpoints. Annex A 8.5 is broader since it concerns authentication across systems and access scenarios, unlike ISM-2109, which specifies a technical requirement tied to pre-boot disk encryption.
This control is broader than ISM-2140.
ISM-2140 requires organisations to disable the OAuth device code flow unless there is a genuine requirement, and where enabled, restrict it to authorised user accounts and managed devices. This is a specific configuration decision that implements secure authentication design consistent with ISO/IEC 27001:2022 Annex A 8.5, which requires secure authentication technologies and procedures aligned to access restrictions and access control policy. Annex A 8.5 is broader across all authentication methods and assurance levels, while ISM-2140 is narrowly focused on controlling a higher-risk OAuth authentication flow.
This control is broader than ISM-2147.
ISM-2147 requires authentication tokens, session cookies and refresh tokens to be cryptographically bound to the device they were issued to so stolen tokens cannot be replayed on another device. ISO/IEC 27001:2022 Annex A 8.5 requires implementing secure authentication technologies and procedures appropriate to access restrictions, which can include token hardening mechanisms such as device binding or token-binding via key material held on the endpoint. Annex A 8.5 is broader (covering authentication methods and procedures generally), while ISM-2147 is a specific technical control pattern focused on session/token replay resistance.
This control is broader than ISM-2165.
ISM-2165 requires a specific behaviour for 802.1X EAP-TLS: each device must perform a fresh EAP-TLS authentication every time a new Connectivity Association Key (CAK) is required, preventing reuse of prior authentication state for key establishment. ISO/IEC 27001:2022 Annex A 8.5 requires secure authentication technologies and procedures to be implemented in line with access restrictions, which can include enforcing re-authentication and robust key establishment for network access. Annex A 8.5 is technology-agnostic and policy-driven, while ISM-2165 is a concrete, protocol-level requirement tied to CAK generation/rekeying events.
This control is broader than ISM-2167.
ISM-2167 addresses secure authentication for MACsec by prohibiting PSK fallback, reducing the risk of weaker authentication being used when the primary method fails. Annex A 8.5 requires secure authentication technologies and procedures to be implemented according to access restrictions, which aligns with ensuring strong, non-downgradeable authentication is enforced for protected communications. Annex A 8.5 is broader and applies across authentication contexts (users, systems, services), while ISM-2167 is limited to MACsec link authentication behaviour.
This control partially meets ISM-0484.
ISM-0484 outlines SSH daemon settings to secure authentication and remote sessions, specifying measures like LoginGraceTime and disabling host-based auth. Annex A 8.5 requires integration of secure authentication methods and technologies. ISM-0484 meets specific technical requirements under the broader guidance of Annex A 8.5 for SSH-based management.
This control partially overlaps ISM-0418.
ISM-0418 requires physical credentials to be stored separately from the systems they authenticate to reduce the chance of immediate compromise if a system is accessed. Annex A 8.5 requires secure authentication technologies and procedures, which include procedural controls around protecting authenticators (including physical tokens) from loss, theft, or easy use. The overlap is procedural protection of authenticators, but Annex A 8.5 spans broader authentication design and management whereas ISM-0418 is narrowly focused on physical co-location and handling at the point of use.
This control partially overlaps ISM-1200.
ISM-1200 requires Bluetooth pairing on sensitive mobile devices to use Secure Connections and preferably Numeric Comparison to ensure the pairing process resists unauthorised access. This overlaps with ISO/IEC 27001:2022 Annex A 8.5 because Bluetooth pairing is an authentication/verification process between devices and relies on secure authentication procedures. Annex A 8.5 is broader across all authentication technologies and access contexts, whereas ISM-1200 is specific to Bluetooth pairing on mobile devices at OFFICIAL: Sensitive and PROTECTED.
- ISM-1327Access controls, encryption and user authentication for X.509 certificatesPartially overlaps
This control partially overlaps ISM-1327.
ISM-1327 requires certificates used for network authentication to be protected using logical and physical access controls, encryption, and user authentication. ISO/IEC 27001:2022 Annex A 8.5 requires secure authentication technologies and procedures, which relates where certificate access is gated by strong user authentication (including MFA) and secure admin authentication to certificate management systems. ISM-1327 also includes physical protection and encryption of certificate material, whereas Annex A 8.5 is primarily about authentication mechanisms rather than protecting certificates as assets.
This control partially overlaps ISM-2012.
ISM-2012 requires re-authentication using all authentication factors to unlock a locked screen and prevents users disabling the locking mechanism. Annex A 8.5 requires secure authentication technologies and procedures to be implemented based on access restrictions and access control policy. They overlap where ISM-2012 mandates a specific authentication procedure for session unlock, while Annex A 8.5 is broader across all authentication scenarios and does not prescribe inactivity timeouts or screen concealment.
This control partially overlaps ISM-2049.
ISM-2049 requires software to invalidate existing authentication state and force re-authentication after permission or credential changes. Annex A 8.5 requires implementing secure authentication technologies and procedures based on access restrictions, which can include session management, token invalidation and re-authentication triggers. They overlap on authentication/session controls, but Annex A 8.5 is broader and principles-based, while ISM-2049 is a specific requirement tied to permission/credential change events.
ASD Essentials for enterprise IT: 2 mappings
- IT.PRO-13.4Enforce phishing-resistant MFA for all user authentication, including from untrusted locationsBroader than
This control is broader than IT.PRO-13.4.
IT.PRO-13.4 requires phishing-resistant MFA for users authenticating to systems, including from untrusted, external or high-risk locations. This is a specific, strong implementation of the secure authentication technologies required by Annex A 8.5. Annex A 8.5 is broader, covering authentication technologies and procedures generally and basing their strength on information access restrictions and the access control policy rather than mandating a particular method.
- IT.PRO-13.5Disable legacy authentication protocols and restrict, monitor and decommission exceptionsBroader than
This control is broader than IT.PRO-13.5.
IT.PRO-13.5 requires legacy authentication protocols to be disabled or, where that is not feasible, restricted, monitored, covered by compensating controls and placed on a time-bound decommissioning plan. Removing weak authentication mechanisms is a specific way of ensuring that only secure authentication technologies are used, as Annex A 8.5 requires. Annex A 8.5 is broader, covering the selection and implementation of secure authentication technologies and procedures in general.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 27001 training
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.