Password Management
Certification criterion
Taking into account legal requirements, external threat factors, and the like, the organization shall establish and implement password management procedures for the passwords used by information system users, customers, members, and other data subjects (users).
Key checkpoints
- Are secure user password management procedures and creation rules for information systems established and implemented?
- Are password creation rules established and implemented so that data subjects (users) can use secure passwords?
- Are the authentication means of personal information handlers or data subjects securely applied and managed?
Detailed explanation
※ This item is a relaxed certification criterion (Annex 7-2) under the special provisions for information security management system certification. The certification criterion and key checkpoints above are the official relaxed/adjusted text; the detailed explanation, related laws, evidence, and nonconformity examples below are the "ISMS-P Certification Criteria Guide" content for Annex 7 [2.5.4 Password Management], which belongs to the same control domain (under the relaxed criteria, this content applies within the scope of the certification criterion and key checkpoints above).
Password management procedures and creation rules shall be established and implemented so that users and administrators can set and use secure passwords.
- Example password creation rules (systematically enforced except where unavoidable)
| Field | Value |
|---|---|
| Apply combination rules | A minimum of 8 characters combining at least 2 of the following types: letters, numbers, special characters A minimum of 10 characters when composed of letters only (however, composing a password of numbers only may be weak) |
| Set a change cycle | Set a validity period for the password and change it periodically (however, whether to change periodically and the change cycle shall be determined internally, taking into account risk assessment results and the like) |
| Restrict easily guessed passwords | Restrict the use of repeated identical characters, character strings adjacent on the keyboard, serial numbers, consecutive numbers, birthdays, phone numbers, and other easily guessed personal information, as well as passwords similar to the ID |
| Restrict reuse of identical passwords | Restrict the reuse of previously used passwords when changing a password |
- Example password management procedures
- Use after changing the initial or temporary password set when the system was introduced
- Apply masking when handling passwords (entry, change)
- Restrict the recording/storing of passwords on paper, files, mobile devices, and the like, and apply protection measures such as encryption when recording/storing is unavoidable
- Change the password without delay when a security incident occurs or when signs of password exposure are suspected
- Perform an identity verification procedure when resetting a password due to loss and the like
- Manage administrator passwords in accordance with their confidentiality grade, and so on
Password creation rules shall be established and implemented so that data subjects (users) can set and use secure passwords.
- Refer to the password creation rules for users and personal information handlers, but apply password creation rules at an appropriate level, taking into account the characteristics and risk level of the service, and the like
- Establish a secure reissuance procedure through identity verification and the like in the event of password loss or theft, and so on
The authentication means of personal information handlers or data subjects shall be securely applied and managed.
- When a password is used as the authentication means of a personal information handler or data subject, establish and apply secure password creation rules
- When authentication means other than passwords are used (certificates, PINs, biometrics, security tokens, and the like), apply protection measures so that the authentication means is not seized or misappropriated by unauthorized persons
[Reference] Applying/managing the authentication means of personal information handlers or data subjects (Article 5(5) of the Standards for Measures to Ensure the Safety of Personal Information)
(5) A personal information controller shall securely apply and manage the authentication means of personal information handlers or data subjects.
Related laws
- Personal Information Protection Act Article 29 (Duty of Safety Measures)
- Standards for Measures to Ensure the Safety of Personal Information Article 5 (Management of Access Rights)
Evidence (examples)
- Password setting screens of web pages, information systems, and personal information processing systems
- Password management policy and procedures
Nonconformity examples
- The case where the criteria for password creation rules are set in information security and personal information protection policies, guidelines, and the like, but some information systems and personal information processing systems use passwords that differ from the internal guidelines
- The case where the internal regulations on passwords require that a temporary password be issued upon reset and forcibly changed, but in practice the temporary password continues to be used as is
- The case where the internal regulations on passwords set and require the implementation of password change cycles for users and personal information handlers, but the passwords are used as is without being changed