Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 CCM-IAM-15: Passwords Management

What else in your programme already covers this

This control maps to 47 controls across 22 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

PCI DSS 4.0 · 9 controls

8.3.11 8.3.11 Tokens, smart cards and certificates individually assigned
8.3.2 8.3.2 Authentication factors unreadable with strong cryptography
8.3.3 8.3.3 Identity verified before factor changes
8.3.5 8.3.5 Initial and reset passwords unique and changed
8.3.7 8.3.7 No reuse of last four passwords
8.3.9 8.3.9 Single-factor passwords changed every 90 days or dynamic analysis
9.2.4 9.2.4 Locking of consoles in sensitive areas
8.6.2 8.6.2 No hard-coded passwords for interactive system accounts
8.6.3 8.6.3 System account passwords protected against misuse

FedRAMP High · 4 controls

IA-5 Authenticator Management
IA-5(1) Password-Based Authentication
IA-5(6) Protection of Authenticators
IA-5(7) Authenticator Management | No Embedded Unencrypted Static Authenticators (IA-5(7))

FedRAMP Moderate · 4 controls

IA-5 Authenticator Management
IA-5(1) Password-Based Authentication
IA-5(6) Protection of Authenticators
IA-5(7) Authenticator Management | No Embedded Unencrypted Static Authenticators (IA-5(7))

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 3 controls

ANSSI-HYG-10 Define and Verify Password Selection and Sizing Rules
ANSSI-HYG-11 Protect Passwords Stored on Systems
ANSSI-HYG-12 Change Default Authentication Elements on Equipment and Services

CMMC 2.0 · 3 controls

IA.L2-3.5.10 Cryptographically-Protected Passwords
IA.L2-3.5.8 Password Reuse
IA.L2-3.5.9 Temporary Passwords

NIST SP 800-171 Rev 3 · 3 controls

03.05.07 Password Management
03.05.11 Authentication Feedback
03.05.12 Authenticator Management

UK Cyber Essentials · 3 controls

CE-SC.2 Change Default Passwords on Devices and Software
CE-SC.5 Password-Based Authentication Quality
CE-SC.8 Process for Compromised Passwords

ASD Strategies to Mitigate Cyber Security Incidents · 2 controls

ASD37-21 Disable local administrator accounts (Excellent)
ASD37-23 Protect authentication credentials (Excellent)

Azure Security Benchmark · 2 controls

ASBv3-IM-8 Restrict the exposure of credential and secrets
IM-3 Manage application identities securely and automatically

C5 (Germany) · 2 controls

C5-IDM-08 Confidentiality of authentication information
C5-PSS-07 Confidentiality of Authentication Information

ACSC Essential Eight · 1 control

E8-ADMIN-ML2 Restrict Administrative Privileges (ML2)

AWS Well-Architected Security Pillar · 1 control

SEC02-BP03 Store and use secrets securely

HIPAA Security Rule · 1 control

164.308(a)(5)(ii)(D) Password Management (Addressable)

NIST Cybersecurity Framework 2.0 · 1 control

NIST-CSF-PR.AA-01 Identities and credentials for authorized users, services, and hardware are managed by the organization

NIST SP 800-161 Rev 1 · 1 control

161R1-IA-5 Authenticator Management

NIST SP 800-53 Rev 5 · 1 control

NIST800-IA-5 IA-5 Authenticator Management

NIST SP 800-66 Rev 2 · 1 control

164.308(a)(5)(ii)(D) Password Management (Addressable)

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 have you already done?

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 CCM-IAM-15 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 140 of 197 Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 controls already carry evidence.

If you hold NIST SP 800-53 Rev 571.1% covered · 57 gaps If you hold FedRAMP Moderate60.4% covered · 78 gaps If you hold PCI DSS 4.060.4% covered · 78 gaps If you hold C5 (Germany)58.4% covered · 82 gaps If you hold ISO 27001:202256.3% covered · 86 gaps If you hold ISO 27002:202256.3% covered · 86 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 12 were rejected on the NIST SP 800-53 Rev 5 pair alone.

See the released pairs, $299 each Browse the graph free