[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-5-17":3},{"item":4,"lessons":16,"controls":38,"related":66},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-5-17","Annex A 5.17","ISO\u002FIEC 27001:2022 Annex A 5.17: Authentication information",5,"International Organization for Standardization (ISO) and IEC","**What it asks for.** This control expects the allocation and management of authentication information, such as passwords, keys and tokens, to be controlled by a management process, including advising personnel on appropriate handling. Its purpose is to make sure entities are authenticated properly and to prevent failures of the authentication process.\n\n**In practice.** Good practice means secure issuing of initial credentials, forcing change of temporary passwords, password rules aligned with current guidance, checking against known compromised passwords and support for password managers. Staff are told not to share or reuse credentials. Auditors look for the process, technical settings in identity systems and evidence of how credentials are issued and reset.\n\n**Common gaps.** Common gaps are weak reset processes open to social engineering, credentials shared in chat or email and secrets for service accounts stored in plain text.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[18,22,26,30,34],{"slug":19,"title":20,"published_at":21},"telco-fined-for-failing-to-verify-identities-enabling-gdpr-violating-fraud","Telco Fined for Failing to Verify Identities, Enabling GDPR-Violating Fraud","2026-10-14T18:20:19.96+00:00",{"slug":23,"title":24,"published_at":25},"deepfake-voice-cloning-exposes-gaps-in-identity-verification","Deepfake Voice Cloning Exposes Gaps in Identity Verification","2026-10-14T14:22:39.372+00:00",{"slug":27,"title":28,"published_at":29},"sim-swap-fraud-exposes-weak-identity-verification-at-digi-spain-telecom","SIM Swap Fraud Exposes Weak Identity Verification at DIGI Spain Telecom","2026-09-16T09:22:25.394+00:00",{"slug":31,"title":32,"published_at":33},"sim-swap-fraud-costs-telecom-200k-under-gdpr","SIM Swap Fraud Costs Telecom €200K Under GDPR","2026-08-13T14:20:40.541+00:00",{"slug":35,"title":36,"published_at":37},"lithuanian-medical-firm-fined-450k-for-weak-access-controls-exposing-383000-health-records","Lithuanian Medical Firm Fined €450K for Weak Access Controls Exposing 383,000 Health Records","2026-07-08T10:20:39.008+00:00",[39,44,48,53,57,62],{"slug":40,"name":41,"problem":42,"stories":43},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",3,{"slug":45,"name":46,"problem":47,"stories":43},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",{"slug":49,"name":50,"problem":51,"stories":52},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",2,{"slug":54,"name":55,"problem":56,"stories":52},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",{"slug":58,"name":59,"problem":60,"stories":61},"breach-attack-simulation","Breach and attack simulation","You only find out whether your security tools stop an attack when a real attacker tries.",1,{"slug":63,"name":64,"problem":65,"stories":61},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[67,72,77,82,87,91,96,99],{"family":68,"item":69,"code":70,"title":71,"together":9},"cis","6","Control 6","Access Control Management",{"family":68,"item":73,"code":74,"title":75,"together":76},"14","Control 14","Security Awareness and Skills Training",4,{"family":78,"item":79,"code":80,"title":81,"together":76},"gdpr","5","Article 5(1)(f)","Principles relating to processing of personal data",{"family":83,"item":84,"code":85,"title":86,"together":76},"nist-sp","800-63","SP 800-63","SP 800-63: Digital Identity Guidelines",{"family":78,"item":88,"code":89,"title":90,"together":76},"32","Article 32","Security of processing",{"family":92,"item":93,"code":94,"title":95,"together":43},"nist-800-53","ac-2","AC-2","Account Management",{"family":78,"item":69,"code":97,"title":98,"together":52},"Article 6","Lawfulness of processing",{"family":78,"item":100,"code":101,"title":102,"together":52},"25","Article 25","Data protection by design and by default"]