Guest
Use of secret authentication information
I have a query on one of the controls in the Annex i.e.. Use of secret authentication information (9.3.1). If the entity opts for the control, what is expected to be maintained as Policy / Procedure and the evidences?
Assign topic to the user
ISO 22301 DOCUMENTATION TOOLKIT
Step-by-step implementation for smaller companies.
Find out more 
ISO 22301 DOCUMENTATION TOOLKIT
Step-by-step implementation for smaller companies.
Find out more
ISO 22301 DOCUMENTATION TOOLKIT
Step-by-step implementation for smaller companies.
Find out more
As you know, this control is for the use of secret authentication information, this means basically that you need to protect the passwords of the users. For this, you can develop a policy (defining length of passwords, share of passwords, change of passwords, etc.), and also you can use software tools (for example Single Sign On) to store and manage them. Obviously the policy and the software can serve as evidence.
For the development of the policy, I recommend you our resource: Password Policy: https://advisera.com/27001academy/documentation/password-policy/
Comment as guest or Sign in
Jan 12, 2016
Jan 12, 2016
Jan 12, 2016