Authentication information
A.5.17
-
Last updated
Applicable
Catalog reference
Manage authentication information (passwords, keys, tokens) securely throughout its lifecycle: allocation, storage, distribution, rotation, and revocation.
Narrative — how we satisfy this requirement
Passwords are generated and kept in the credential vault, and engineers use hardware security keys for privileged accounts.