Password policy under ISO 27001 (A.5.17) with example
A password policy under ISO 27001 records how your organisation issues, uses and protects passwords and other login credentials. In ISO/IEC 27001:2022 , this falls under control A.5.17 “Authentication information” in Annex A. The technical side, such as multi-factor authentication (MFA), belongs to A.8.5 “Secure authentication”.
The NCSC (Netherlands National Cyber Security Centre) recommends a passphrase of at least 12 characters and advises two-factor authentication wherever possible. A good ISO 27001 password policy turns this kind of advice into rules that your systems actually enforce, and it aligns with your access rights matrix.
Short answer: ISO 27001 does not prescribe a fixed password length or change frequency. You set the rules yourself based on your risks (A.5.17), enforce them technically (A.8.5) and can show that they work. A modern policy focuses on long passphrases, a password manager and MFA, not on complicated characters and monthly changes.
What does ISO 27001 require from a password policy?
Annex A gives only the title and a short description. The detailed guidance is in ISO 27002:2022 . Four controls are relevant:
| Control | Title (ISO/IEC 27001:2022) | What it covers |
|---|---|---|
| A.5.17 | Authentication information | Issuing, use and management of passwords, PIN codes and tokens |
| A.8.5 | Secure authentication | Technical login protection, such as MFA and locking after failed attempts |
| A.5.16 | Identity management | Each account belongs to one person or one system |
| A.8.2 | Privileged access rights | Additional requirements for administrator accounts |
In essence, A.5.17 requires you to issue login credentials through a defined process, to have users keep them confidential and to change them immediately if you suspect misuse. The standard leaves the concrete implementation up to you. That is why your choices must be traceable to your risk assessment.
Example ISO 27001 password policy
The text below is written for an organisation that uses Microsoft 365 or Google Workspace, a password manager and roughly 20 to 100 employees. Adopt what fits and remove what does not match your systems.
Password and authentication policy Version 2.0, approved by the board of directors on 14 January 2026. Owner: IT manager. Belongs to ISO 27001 A.5.17 and A.8.5.
1. Length. A password is at least 12 characters long. We recommend a passphrase of four or more words. Administrator accounts use at least 16 characters.
2. Unique. You use a different password for each system. You never use your work password for personal services.
3. Password manager. Every employee receives the company password manager. You store passwords there, not in a browser, an Excel file or on paper.
4. Multi-factor authentication. MFA is switched on for email, the cloud environment, the password manager, VPN and all administrator accounts. Where the system supports it, we use passkeys or an authenticator app instead of SMS.
5. Changing. You do not need to change your password on a schedule. You change it immediately if you suspect it has become known, and you report this as a security incident.
6. Sharing. You do not share your password with anyone, including IT or your manager. Shared accounts are only allowed with the approval of the IT manager and are managed in a shared vault in the password manager.
7. Issuing. New accounts receive a one-time starting password that must be changed at first sign-in. The starting password is sent through a different channel from the username.
8. Lockout. After 10 failed attempts, an account is locked for 15 minutes.
9. Default passwords. Default passwords on new equipment and software are changed before the device connects to the network.
10. Storage by systems. Our own applications store passwords only in hashed form, using a modern algorithm such as Argon2 or PBKDF2.
The numbers in this example are choices, not requirements of the standard. For example, the NCSC mentions temporarily locking an account after 5 failed attempts as an option in its tips for organisations . Record why you choose a particular value.
Do you need to change passwords regularly under ISO 27001?
No. ISO 27001 does not prescribe a change frequency. Forced changes every 90 days often lead to predictable patterns such as “Summer2026!” followed by “Autumn2026!”. The NCSC advises changing your password when you suspect it has become known somewhere.
If you still choose periodic changes, for example because a client contract requires it, record that as a deliberate choice with the reason behind it. The auditor checks whether your policy is justified, not whether it follows a particular trend.
Enforce the password policy technically
A policy that exists only on paper does not survive the first busy week. Build the rules into your systems. In practice, this looks as follows:
| Rule from the policy | Where you set it | Evidence for the audit |
|---|---|---|
| Minimum length 12 characters | Password policy in Entra ID or Google Admin | Screenshot of the setting |
| MFA required | Conditional Access or enforced two-step verification | Report of MFA status per user |
| Lock after failed attempts | Smart lockout or a similar feature | Overview of the settings |
| Password manager for everyone | Licence overview of the password manager | Number of active users compared with number of employees |
| Administrators separate | Separate administrator accounts without a mailbox | List of administrator accounts |
What does the auditor ask for as evidence for A.5.17 and A.8.5?
The auditor wants to see that the policy exists, that it is enforced and that exceptions are controlled. Expect these questions during the ISO 27001 audit:
- Show the approved password policy, with version and approval.
- Show the settings in your identity system: length, MFA and lockout.
- How many accounts do not have MFA, and why not?
- How does a new employee receive their first password?
- Who manages shared accounts, and where are those passwords stored?
- What did you do the last time you suspected a password had leaked?
Many findings concern exceptions: an old service account without MFA, or a shared administrator password in a spreadsheet. Before the audit, run a report of all accounts without MFA and record for each account why that is the case.
Common mistakes in a password policy
Complexity rules without length. “8 characters with an uppercase letter, a number and a symbol” produces weak passwords. Length helps more.
Not providing a password manager. Anyone who has to remember twenty unique passwords will reuse them or write them down. Give people the tools.
MFA only for email. Administrator accounts and the password manager itself need MFA most of all.
Forgetting suppliers. External administrators often have their own accounts in your environment. Include them in the policy and in your supplier management.
Policy and practice differ. If the policy says “14 characters” and your system enforces 8, that is a deviation. Change either the policy or the system.
Password policy and your statement of applicability
In your statement of applicability, you almost always mark A.5.17 and A.8.5 as applicable. In the “reference” column, refer to this policy and to the technical settings. That way the auditor can move from control to evidence in one step.
Do you work for the government? The BIO2 (Dutch government baseline for information security) turns some of these choices into mandatory government measures, such as MFA for internet-facing accounts and administrator accounts, and a password manager for all employees.
Frequently asked questions about the password policy
Is MFA mandatory for ISO 27001?
Not literally. A.8.5 requires secure authentication that fits your risks. For email, cloud environments and administrator accounts, it is hard to justify not using MFA.
Can a password manager be in the cloud?
Yes, if you assess it as a supplier and protect the vault itself with a strong master passphrase and MFA. The NCSC offers tips on choosing a password manager .
More information
- Annex A: all 93 controls, including identity and access management
- Access rights matrix: who gets access to which system
- Clean desk policy: screen locking and no passwords on sticky notes
- Remote working and BYOD policy: signing in from personal devices
- Incident management: what to do when a password has leaked
- NCSC: how to use your passwords safely