ISO 27001:2022 overview
ISO/IEC 27001:2022 is the international standard for Information Security Management Systems (ISMS). It provides a framework for establishing, implementing, maintaining, and continually improving an ISMS — a systematic approach to managing sensitive information. Certification to ISO 27001 demonstrates to customers, partners, and regulators that your organisation has implemented documented and audited controls for information security.
The 2022 revision (replacing ISO 27001:2013) restructured Annex A, reducing the number of controls from 114 to 93 and grouping them into four themes: Organisational, People, Physical, and Technological. Password and authentication controls appear primarily under Annex A.9 (Access Control) in the technological theme, though authentication is also referenced in Annex A.8 (Asset Management).
Annex A.9 access control
Annex A.9 in ISO 27001:2022 maps to the following controls. The controls most relevant to password management:
| Control | Title | Key requirement |
|---|---|---|
| A.9.2.1 | User registration and de-registration | Formal process for granting and removing access |
| A.9.2.2 | User access provisioning | Formal authorisation for access rights |
| A.9.2.3 | Management of privileged access rights | Separate management of privileged credentials |
| A.9.2.4 | Management of secret authentication information | Password management policy and controls |
| A.9.2.5 | Review of user access rights | Periodic access reviews |
| A.9.2.6 | Removal or adjustment of access rights | Timely revocation on role change or departure |
| A.9.3.1 | Use of secret authentication information | User obligations for credential handling |
| A.9.4.2 | Secure log-on procedures | Authentication process controls |
| A.9.4.3 | Password management system | Technical password system requirements |
Specific password requirements
ISO 27001 does not mandate specific password lengths in the standard text. Instead, it requires organisations to implement "appropriate" controls and to reference ISO 27002 for implementation guidance. ISO 27002:2022 (the companion guidance document) provides specific recommendations for A.9.4.3 (Password management system):
- Enforce minimum password quality — length, character composition, and avoidance of common or guessable passwords
- Require users to change temporary passwords on first use
- Keep a history of previous passwords and prevent reuse
- Not display passwords on screen during entry
- Store password files separately from application system data
- Store and transmit passwords in protected form only (hashed, not plaintext)
For certification purposes, auditors evaluate whether your stated password standards are "appropriate" for the sensitivity classification of the information being protected. Industry consensus for ISO 27001 certification:
Secret authenticator management (A.9.2.4)
A.9.2.4 specifically covers the management of secret authentication information — passwords, PINs, and cryptographic keys. The ISO 27002 guidance for this control requires:
- All users must sign an agreement to keep personal authentication information confidential
- Initial passwords must be temporary, unique, and changed on first use
- System administrators must never send passwords in plaintext — use secure delivery mechanisms
- Passwords must not be stored in readable format anywhere in the system
- Default system passwords must be changed after installation
For password managers: ISO 27002 explicitly recommends password management tools as an implementation mechanism for this control. Organisations that deploy enterprise password managers (1Password Business, Bitwarden Teams) and can demonstrate adoption are generally viewed favourably by auditors on A.9.2.4 compliance.
User access management (A.9.2)
A.9.2 covers the full lifecycle of user access: provisioning, modification, and revocation. The key controls that auditors examine alongside password requirements:
- A.9.2.1 Registration: Formal process documented for granting accounts. No ad-hoc access grants. New accounts require written authorisation.
- A.9.2.2 Provisioning: Access granted based on least-privilege. Business justification required for each access grant. No "copy from existing user" as sole basis for access.
- A.9.2.5 Review: Periodic review of who has access to what. Frequency depends on sensitivity — quarterly for privileged access, semi-annual for standard. Reviews must be documented with evidence of who performed the review and when.
- A.9.2.6 Revocation: Access revoked promptly on departure or role change. Documented timelines in the offboarding procedure. HR process must trigger IT action.
Privileged access management (A.9.2.3)
ISO 27001 treats privileged access management as a separate, higher-risk control. Auditors scrutinise this more than standard user access. Requirements:
- Inventory of all privileged accounts — system administrators, database admins, network administrators, cloud console access
- Privileged accounts must not be used for routine non-privileged activities — dual accounts for administrators
- Strong, unique passwords for each privileged account — 14–20 characters, randomly generated
- Privileged account credentials stored in a privileged access management (PAM) solution or equivalent vault
- Regular rotation of privileged credentials — at minimum on departure of any administrator
- All privileged access activity logged and reviewed
MFA under ISO 27001
ISO 27001:2022 added a new control — A.8.5 (Secure Authentication) — that explicitly addresses multi-factor authentication. The ISO 27002 guidance for A.8.5 states that MFA should be used for all privileged access and for all remote access, and recommends it for general user access to sensitive systems.
For certification purposes, MFA is expected for:
- All remote access (VPN, SSH, RDP)
- All cloud infrastructure console access (AWS, Azure, GCP)
- All privileged accounts without exception
- Access to systems handling personal data, financial data, or other classified information
Phishing-resistant MFA — hardware FIDO2 keys — is noted in ISO 27002 as the strongest option. For organisations seeking certification to both ISO 27001 and SOC 2 simultaneously, hardware keys for admin accounts satisfy both standards.
ISMS documentation requirements
ISO 27001 requires formal documentation. For access and password controls:
- Information Security Policy (mandatory): Top-level policy establishing the ISMS
- Access Control Policy: Password standards, MFA requirements, session controls
- User Access Management Procedure: Provisioning, modification, revocation workflows
- Privileged Access Management Procedure: How privileged credentials are issued, stored, rotated, and audited
- Risk Assessment: ISO 27001 requires a formal risk assessment. Authentication strength is a risk treatment for the credential theft risk.
- Statement of Applicability (SoA): Documents which Annex A controls apply to your organisation and why
- Access Review Records: Evidence of completed periodic access reviews
Path to certification
ISO 27001 certification requires a two-stage audit by an accredited certification body (BSI, Bureau Veritas, DNV, LRQA, etc.):
- Stage 1 (Documentation review): Auditor reviews your ISMS documentation — policies, procedures, risk assessment, Statement of Applicability. No on-site testing.
- Stage 2 (Certification audit): Auditor tests whether controls are actually operational. Interviews, system configuration reviews, evidence requests.
Common password-related findings in Stage 2 audits: password policies not technically enforced, MFA deployed but not mandatory, access reviews completed on paper but not documented, privileged account passwords not rotated on administrator departure.
Once certified, surveillance audits occur annually and recertification every three years.