ISO 27001 A.5.17: Authentication information

Write an authentication management policy covering all credential types in use: passwords, MFA tokens, certificates, API keys, and anything else. For passwords, set sensible minimums: 12+ characters, block commonly breached passwords (use a breach database check), require change on first use, and prohibit reuse across systems. Store passwords with proper salted hashing (bcrypt, scrypt, or Argon2). Skip overly complex character requirements in favour of length and passphrase support. Roll out MFA for all remote access, privileged access, and anything touching sensitive data. Authenticator apps or FIDO2 hardware keys are preferred - avoid SMS-based codes where possible due to SIM-swapping risks. Be explicit about which systems require MFA. Lock down the credential issuance process. Initial passwords must be temporary and force a change on first login. Verify identity before performing resets, using out-of-band verification. Never email passwords in plain text. Use secure, time-limited delivery mechanisms. Deploy supporting technical controls. Push password managers to help people maintain unique credentials. Run credential monitoring to detect passwords that have appeared in breach databases. Implement lockout or throttling to stop brute-force attacks. Use certificate or token-based auth for service-to-service communication. Train everyone on credential hygiene: do not share credentials, recognise phishing, use a password manager, and report suspected compromise immediately.