# ISO 27001: Password policy requirements and management ISO 27001 certification rewards organizations that demonstrate their security controls work consistently, for every user, on every system, over time. An ISO 27001 password policy sits close to the center of that demonstration. Credentials govern who reaches which systems, and the records a password management system produces become part of the evidence an auditor reviews. This guide covers what ISO/IEC 27001:2022 requires and which Annex A controls a password policy supports. It also explains how current guidance from the National Institute of Standards and Technology, or NIST, informs technical password decisions and where a password manager contributes to certification readiness. ## What is ISO 27001? ISO 27001 is the international standard for information security management systems. The International Organization for Standardization, or ISO, and the International Electrotechnical Commission, or IEC, jointly published the current version, ISO/IEC 27001:2022, in October 2022. ## What an ISMS is and how certification works An information security management system, or ISMS, is the documented set of policies, processes, roles, and controls an organization uses to manage information security risk. ISO/IEC 27001:2022 requires organizations to define the scope of the system, assess information security risks, decide how to treat those risks, implement the selected controls, and measure whether the controls work. Independent certification bodies issue the certificate; ISO publishes the standard. Certification then follows a defined cycle: - Auditors review documentation and examine implementation prior to initial certification - Surveillance audits are conducted annually with full recertification on a three-year cycle - This standard requires continual improvement, so work continues even after the certificate arrives ## Annex A and the Statement of Applicability Annex A of ISO/IEC 27001:2022 lists 93 reference controls organized under four themes: 37 organizational controls, 8 people controls, 14 physical controls, and 34 technological controls. Organizations select from the reference set rather than automatically implementing all 93. An organization’s risk treatment determines which controls apply. Each organization compares the controls it has selected against Annex A, records the result in a Statement of Applicability, and justifies both the inclusions and the exclusions. Auditors examine that document closely because it connects identified risks to the controls chosen to address them. ## Which controls does an ISO 27001 password policy support? A password policy supports several Annex A controls rather than satisfying any single one. It contributes to authentication information handling, access control, identity lifecycle management, secure authentication, and segregation of duties. It also produces evidence, in the form of policy configurations, event logs, and reporting, that shows how those controls operate over time. The sections below cover what a password policy contributes to each control and where its contribution ends. ### **Annex A 5.17: Authentication information** Annex A 5.17 covers the allocation and management of authentication information. The control calls for a defined management process and requires the organization to advise personnel on proper credential handling. A password policy supports this control through controlled allocation and secure generation. Administrators share credentials through encrypted, permission-based sharing, so every handoff has defined access rights and leaves an access record. A password generator creates long, unique values when accounts are set up. When a credential is exposed, the response is simple: find every account that uses it, change the password, and confirm the change.  **Evidence:** The evidence may include credential generation policies; sharing configurations; reports identifying weak, reused, or exposed credentials; and remediation records confirming resolution of those findings. **Limitation:** The control covers a full management process, including personnel guidance and approval workflows. A password manager carries part of that process; the documented policy and the training behind it come from the organization. ### **Annex A 5.15 and 5.16: Access and identity management** Annex A 5.15 requires rules controlling physical and logical access to information based on business and information security requirements. Annex A 5.16 requires management of the full identity lifecycle. Annex A 5.18 access rights, covers provisioning, review, and removal. Centralized password management gives these controls a single place to operate. Role-based groups and shared credential spaces assign access by role so least privilege becomes a configuration that an administrator only has to set once. Directory integration and provisioning keep the credential store aligned with the identity source, so onboarding and succession move together. When someone changes roles, access reassignment happens in the same system that recorded the original grant. Granular access controls give that structure the precision an ISO 27001 audit expects. **Evidence:**Group membership and sharing permission records, provisioning logs, access review documentation, and deprovisioning records are tied to specific dates and administrators.  **Limitation:** The source of truth for identity remains the directory or identity provider. A password manager reflects and enforces those decisions, and identity governance stays with the provider. ### **Annex A 8.5: Secure authentication** Annex A 8.5 requires secure authentication technologies and procedures based on information access restrictions and a topic-specific access control policy. Unique credentials for every account keep each login traceable to a single identity. Multifactor authentication, or MFA, raises the assurance level of the login itself. When using log in with single sign-on, it routes authentication through the identity provider, so one authentication policy applies everywhere. Encrypted vaults protect stored authentication information at rest and in transit, and defined recovery paths keep account access available while the authentication model stays intact. Risk decisions drive which authenticator applies where, and the standard expects organizations to make and document that distinction. An auditor then evaluates that reasoning as it appears in the risk treatment plan. ### **More controls** A password policy touches several further controls: - **Annex A 5.3, segregation of duties:** Granular sharing permissions keep conflicting responsibilities separated  - **Annex A 5.34, privacy and protection of personally identifiable information:** Access limits govern how many people can access any systems holding personal data - **Annex A 8.1, user endpoint devices:** Vault clients keep stored information encrypted on laptops and mobile devices - **Annex A 8.4, access to source code, development tools, and software libraries:** Secrets management separates developer credentials from workforce credentials ## How does NIST guidance support an ISO 27001 password policy? Mapping controls determines which requirements apply, but the standard deliberately remains quiet about what the password rules should say. ISO/IEC 27001:2022 does not mandate password length, character composition formula, or rotation schedule; organizations define enforceable authentication requirements themselves and justify those decisions through risk assessment. NIST guidance supplies the technical benchmark that helps fill that space. NIST Special Publication 800-63B describes password practices that organizations evaluate through their own risk process. Following NIST guidance does not establish ISO 27001 conformity or produce certification on its own. It gives an organization a defensible answer when an auditor asks why the password rules are what they are. ### **Use NIST guidance as an implementation benchmark** Current NIST password guidelines recommend a minimum of 15 characters for user-chosen passwords, with 8 characters as the minimum a verifier must enforce. The guidance also calls for: - screening new and changed passwords against blocklists of compromised values. - rate limiting to slow repeated authentication attempts. - storing password verifiers with salted hashing and an approved key derivation function. - supporting password managers, including autofill and paste. These practices provide an organization with a technical baseline for evaluating risks in an ISO 27001 risk assessment. They remain implementation guidance; ISO does not mandate password rules of its own. ### **Replace arbitrary complexity and rotation rules** Password policy best practices have shifted away from mandatory character-composition rules and scheduled password expirations in the absence of evidence of compromise. Both push people toward predictable patterns and incremental variations, the undesired behavior NIST cites in moving away from them. Length, uniqueness, and generated values do more. A password generator produces a distinct value per account. Screening against exposed-credential data catches values already circulating. Using this information to create a password rotation policy that is triggered by evidence of compromise ties the change to a real event rather than a calendar. Some organizations carry stricter requirements from regulations, contractual commitments, identified risks, or legacy systems that accept only shorter passwords. Those requirements and any exceptions belong in the documented password policy alongside the reasoning behind them, because auditors examine the justification as closely as the rule. ### **Layer passwords with stronger authentication** Phishing resistance comes from the authenticator rather than from the secret itself, so neither password length nor complexity provides it. MFA, single sign-on, and phishing-resistant authenticators like passkeys and hardware security keys are applied according to risk, with priority for privileged, administrative, remote, and high-impact access. A password policy connects to that layered model in four ways: consistent policy enforcement across the workforce, reduced credential reuse, lifecycle controls tied to the identity source, and records demonstrating that authentication controls operated throughout the audit period. This last item is the one an audit actually samples. ## How a password manager supports an ISO 27001 password policy Annex A defines the target, and NIST guidance sets the technical baseline. A password manager for compliance is where both turn into daily practice. Certification evaluates the entire information security management system, and what a password manager product contributes to is consistent enforcement and a record that enforcement occurred. ### **Secure generation, storage, and sharing** Bitwarden is a zero-knowledge encryption solution in which credentials are encrypted and decrypted on the client, and the stored values remain unreadable to the vendor. Collections give teams a controlled place to share credentials, with permissions granted to users or groups of users. Approved sharing replaces the spreadsheet, the shared document, and the chat message, keeping credentials in a system that records every access. ### **One console for roles, provisioning, and removal** Enterprise policies apply the same rules to all members and are set at the organization level. Account recovery maintains access when someone loses a device, while deprovisioning removes access on an organization-defined schedule. An enterprise password manager brings roles, groups, directory sync, and policies into a single administrative console. ### **Reports and password audit evidence** Auditors sample records over a defined window, so certification depends on demonstrating that controls operated consistently throughout the full period, not just at the time of review. Access Intelligence surfaces weak, reused, and exposed credentials, accounts missing MFA, and the remediation record that follows a report turns a finding into evidence. Event logs capture who accessed what and when, with timestamps that auditors can sample directly, and password protection audit logs give that history a defined retention path. Policy configurations show what the organization requires, while training records, documented exceptions, and remediation notes complete the picture. ## Bitwarden ISO 27001 certification Beyond supporting a customer's own certification effort, Bitwarden holds ISO 27001 certification itself. As of March 2025, Bitwarden is ISO 27001-certified, covering control sets related to data security. That certification covers the Bitwarden information security management system. It does not extend to a customer’s ISMS. An organization pursuing certification defines its own scope, selects its own controls, and undergoes its own audit. Vendor certification reduces the assessment burden for one component of that scope and supplies documentation that the audit references. Teams that review relevant cybersecurity compliance standards early map vendor evidence to their own control set more quickly. ## Support an ISO 27001 password policy with Bitwarden Bitwarden Password Manager gives security and IT teams the credential controls, administrative policies, and reporting that Annex A evidence depends on. Start a free trial of the Enterprise plan and map those capabilities to a Statement of Applicability. ## ISO 27001 password policy FAQs **Must every Annex A control be implemented?** No. Annex A is a reference set of 93 controls, and risk treatment determines which of them an organization applies. The Statement of Applicability records that decision, listing the controls in scope, the justification for including them, and the reasoning behind any exclusion. Auditors assess whether the selection follows from the risk assessment and whether the justification holds. **Does ISO require a password length or a 90-day expiration?** ISO 27001 sets no such requirement. ISO/IEC 27001:2022 specifies no password length, complexity formula, or expiration interval, so the organization defines enforceable authentication requirements and justifies them through risk assessment. Many teams adopt NIST password guidelines as the password policy baseline, then document any stricter requirements created by a regulation, a contract, or a legacy system. A password rotation policy triggered by evidence of compromise aligns with current guidance and provides auditors with a clear rationale for evaluation. **Does a password manager make a company compliant?** No. Certification evaluates the full information security management system: scope, risk assessment, control implementation, governance, evidence, and continual improvement. A password manager is one of the supporting components within that scope. ## 強力で信頼できるパスワードセキュリティを今すぐ。プランを選択してください。 ## パーソナル ### 始めたばかりですか？ *今すぐ、基本的なパスワード管理を始めましょう。ずっと無料です。* *月あたり* *永久無料* Bitwardenの保管庫を利用する ボールトのアイテムを他の 1 人のユーザーと共有する [今すぐ利用開始](https://bitwarden.com/go/start-free/) --- ### プレミアム **$1.65** *月あたり* *年間 $19.80 ドル請求されます* プレミアム機能をお楽しみください - Bitwarden 認証器 - ファイル添付 - 緊急アクセス - フィッシング対策 - セキュリティレポートなど ボールトのアイテムを他の 1 人のユーザーと共有する [プレミアム アカウントを作成する](https://bitwarden.com/go/start-premium/) --- ### 家族 **$3.99** *月あたり* *最大 6 ユーザー、年間 $47.88 請求されます* あなたの家族のログインを保護してください - 6 つのプレミアムアカウント - 無制限の共有 - 無制限のコレクション - 組織のストレージ ボールトのアイテムを 6 人で共有する [ファミリープランの無料トライアルを開始](https://bitwarden.com/go/start-families-trial/) --- 価格は米ドルで表示され、年間サブスクリプションに基づいています。税別。 ## ビジネス ### チーム *成長するチームのための強固な保護* **$4** *月額/ユーザーごとに毎年請求* **妥協なし** 同僚、部門間、または全社と安全に機密データを共有する - 認証情報を安全に共有する - イベントログでアクティビティを追跡する - 既存のディレクトリを同期する - SCIM によるプロビジョニングの自動化 すべてのユーザーにプレミアム機能を含む [トライアルを開始する](https://bitwarden.com/go/start-teams-trial/) --- ### 企業 *大規模組織向けの高度な機能* **$6** *月額/ユーザーごとに毎年請求* **最大限の保護** エンタープライズ ポリシー、パスワードなしの SSO、アカウントの回復などの高度な機能を利用する。 - きめ細かなアクセス制御 - パスワードレスSSO統合 - 簡単なアカウント回復 - セルフホストの柔軟性 - アクセス・インテリジェンスのリスク修復 [新規］ - すべてのユーザー向けの無料ファミリープラン すべてのユーザー向けのプレミアム機能と補完的なファミリー プランが含まれる [トライアルを開始する](https://bitwarden.com/go/start-enterprise-trial/) --- ### 営業に問い合わせる *数百人または数千人の従業員を持つ企業のために、カスタム見積もりを取得するために営業に連絡し、Bitwarden がどのように役立つかを確認してください：* *per month* - サイバーセキュリティ リスクを軽減する - 生産性を向上させる - シームレスに統合する Bitwarden は、パスワードのセキュリティを貴組織にもたらすために、どんな規模のビジネスにも対応する。 [営業に問い合わせる](https://bitwarden.com/talk-to-sales/) --- 価格は米ドルで表示され、年間サブスクリプションに基づいています。税別。