ISO 27001A.5 — Authentication information
A.5.17
Authentication information
ISO 27001 · ISO/IEC 27001:2022 · Last verified July 2026
Objective
Control allocation and management of authentication information — passwords, keys, tokens, and related secrets.
Points of focus
- Rules for password/passkey/token quality
- Secure distribution of initial secrets
- Storage of shared or system secrets
- Revocation on leaver or compromise
Implementation notes
Prefer SSO + MFA and phishing-resistant factors for humans. Put service credentials in a secret manager with owners and rotation. Ban secrets in git via scanning. On leaver, revoke IdP sessions, PATs, and cloud keys. Crosswalk to A.8.5 and SOC 2 CC6 authentication themes.
Audit tip: Show how a production API key is stored, owned, and rotated — and a recent rotation record.
Evidence auditors typically request:
- Authentication / password standard
- IdP MFA and password-policy screenshots
- Secret manager usage for service credentials
- Rotation tickets for production secrets
Common gaps
- Shared admin passwords in chat
- Long-lived API keys in CI without owner
- Leaver disables user but leaves PATs active
Cross-Framework Mapping
| Framework | Requirement | Implementation note |
|---|---|---|
| ISO 27001 | A.5.17 | This control |
| SOC 2 | CC6.1, CC6.6 | Related Trust Services Criteria themes — map in your crosswalk; not identical requirements. |
| GDPR | Article 32 | Related GDPR articles for personal-data security or processor themes — not a compliance claim. |
| HIPAA | 164.312(d) | Related HIPAA Security Rule citations when PHI is in scope — SoA does not replace BAAs. |
Primary sources
- ISO/IEC 27001:2022 Annex A: ISO/IEC 27001:2022 Annex A (A.5.17)
Frequently Asked Questions
Yes for workforce secrets when enterprise-managed; still prefer SSO to reduce password sprawl.
Passkeys improve authenticator strength but you still need lifecycle, recovery, and service-account secret management.
When PHI is in scope, authentication strength supports Security Rule access controls — document decisions alongside BAAs.