NIST SP 800-171 Rev 3 03.05.07: Password Management

What else in your programme already covers this

This control maps to 36 controls across 22 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

UK Cyber Essentials · 5 controls

CE-FW.2 Change Default Firewall Passwords
CE-SC.2 Change Default Passwords on Devices and Software
CE-SC.5 Password-Based Authentication Quality
CE-SC.7 Educate Users on Strong Passwords
CE-SC.8 Process for Compromised Passwords

CMMC 2.0 · 4 controls

IA.L2-3.5.10 Cryptographically-Protected Passwords
IA.L2-3.5.7 Password Complexity
IA.L2-3.5.8 Password Reuse
IA.L2-3.5.9 Temporary Passwords

C5 (Germany) · 3 controls

C5-IDM-08 Confidentiality of authentication information
C5-IDM-09 Authentication mechanisms
C5-PSS-07 Confidentiality of Authentication Information

PCI DSS 4.0 · 3 controls

8.3.2 8.3.2 Authentication factors unreadable with strong cryptography
8.3.5 8.3.5 Initial and reset passwords unique and changed
8.3.6 8.3.6 Password minimum length 12 and complexity

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 2 controls

ANSSI-HYG-10 Define and Verify Password Selection and Sizing Rules
ANSSI-HYG-11 Protect Passwords Stored on Systems

AWS Well-Architected Security Pillar · 2 controls

SEC02-BP01 Use strong sign-in mechanisms
SEC02-BP03 Store and use secrets securely

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 2 controls

CCM-IAM-02 Strong Password Policy and Procedures
CCM-IAM-15 Passwords Management

Australia Consumer Data Right - Banking (CDR) · 1 control

AUCDR-IS-1 Limit risk of unauthorised access to the CDR data environment

Azure Security Benchmark · 1 control

ASBv3-IM-8 Restrict the exposure of credential and secrets

FedRAMP High · 1 control

IA-5(1) Password-Based Authentication

HIPAA Security Rule · 1 control

164.308(a)(5)(ii)(D) Password Management (Addressable)

ISO 27701:2019 · 1 control

6.6.4 System and application access control

NIST Cybersecurity Framework 2.0 · 1 control

NIST-CSF-PR.AA-01 Identities and credentials for authorized users, services, and hardware are managed by the organization

NIST SP 800-161 Rev 1 · 1 control

161R1-IA-5 Authenticator Management

NIST SP 800-53 Rev 5 · 1 control

NIST800-IA-5 IA-5 Authenticator Management

NIST SP 800-66 Rev 2 · 1 control

164.308(a)(5)(ii)(D) Password Management (Addressable)

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of NIST SP 800-171 Rev 3 have you already done?

NIST SP 800-171 Rev 3 03.05.07 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of NIST SP 800-171 Rev 3 your existing evidence covers. Hold PCI DSS 4.0 and 69 of 97 NIST SP 800-171 Rev 3 controls already carry evidence.

If you hold PCI DSS 4.071.1% covered · 28 gaps If you hold C5 (Germany)68% covered · 31 gaps If you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.164.9% covered · 34 gaps If you hold ISO 27001:202262.9% covered · 36 gaps If you hold CIS Controls v853.6% covered · 45 gaps If you hold NIST SP 800-161 Rev 152.6% covered · 46 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the PCI DSS 4.0 pair alone.

See the released pairs, $299 each Browse the graph free