What it asks for. This control expects the allocation and management of authentication information, such as passwords, keys and tokens, to be controlled by a management process, including advising personnel on appropriate handling. Its purpose is to make sure entities are authenticated properly and to prevent failures of the authentication process.
In practice. Good practice means secure issuing of initial credentials, forcing change of temporary passwords, password rules aligned with current guidance, checking against known compromised passwords and support for password managers. Staff are told not to share or reuse credentials. Auditors look for the process, technical settings in identity systems and evidence of how credentials are issued and reset.
Common gaps. Common gaps are weak reset processes open to social engineering, credentials shared in chat or email and secrets for service accounts stored in plain text.