Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 CCM-IAM-02: Strong Password Policy and Procedures

What else in your programme already covers this

This control maps to 36 controls across 22 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

PCI DSS 4.0 · 7 controls

2.2.2 2.2.2 Vendor default accounts managed
8.3.10 8.3.10 Service provider customer password guidance
8.3.10.1 8.3.10.1 Service provider customer passwords 90 days or dynamic
8.3.6 8.3.6 Password minimum length 12 and complexity
8.3.7 8.3.7 No reuse of last four passwords
8.3.8 8.3.8 Authentication policies communicated to users
8.3.9 8.3.9 Single-factor passwords changed every 90 days or dynamic analysis

NIST SP 800-171 Rev 3 · 3 controls

03.01.08 Unsuccessful Logon Attempts
03.05.07 Password Management
03.05.12 Authenticator Management

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 2 controls

ANSSI-HYG-10 Define and Verify Password Selection and Sizing Rules
ANSSI-HYG-11 Protect Passwords Stored on Systems

C5 (Germany) · 2 controls

C5-IDM-08 Confidentiality of authentication information
C5-IDM-09 Authentication mechanisms

CMMC 2.0 · 2 controls

IA.L2-3.5.7 Password Complexity
IA.L2-3.5.8 Password Reuse

FedRAMP High · 2 controls

IA-5 Authenticator Management
IA-5(1) Password-Based Authentication

FedRAMP Moderate · 2 controls

IA-5 Authenticator Management
IA-5(1) Password-Based Authentication

UK Cyber Essentials · 2 controls

CE-SC.5 Password-Based Authentication Quality
CE-SC.7 Educate Users on Strong Passwords

ACSC Essential Eight · 1 control

E8-ADMIN-ML2 Restrict Administrative Privileges (ML2)

ASD Strategies to Mitigate Cyber Security Incidents · 1 control

ASD37-21 Disable local administrator accounts (Excellent)

AWS Well-Architected Security Pillar · 1 control

SEC02-BP01 Use strong sign-in mechanisms

Azure Security Benchmark · 1 control

IM-6 Use strong authentication controls

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.1 · 1 control

IAM-02 Credentials Management Policy and Procedures

HIPAA Security Rule · 1 control

164.308(a)(5)(ii)(D) Password Management (Addressable)

NIST Cybersecurity Framework 2.0 · 1 control

NIST-CSF-PR.AA-01 Identities and credentials for authorized users, services, and hardware are managed by the organization

NIST SP 800-53 Rev 5 · 1 control

NIST800-IA-5 IA-5 Authenticator Management

NIST SP 800-66 Rev 2 · 1 control

164.308(a)(5)(ii)(D) Password Management (Addressable)

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 have you already done?

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 CCM-IAM-02 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 140 of 197 Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 controls already carry evidence.

If you hold NIST SP 800-53 Rev 571.1% covered · 57 gaps If you hold FedRAMP Moderate60.4% covered · 78 gaps If you hold PCI DSS 4.060.4% covered · 78 gaps If you hold C5 (Germany)58.4% covered · 82 gaps If you hold ISO 27001:202256.3% covered · 86 gaps If you hold ISO 27002:202256.3% covered · 86 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 12 were rejected on the NIST SP 800-53 Rev 5 pair alone.

See the released pairs, $299 each Browse the graph free