Password quality, manual
A manual password review tests a sample against the password policy.
What the published 2016 guidance says
A manual password review tests a sample against the password policy. The construct reports the share of passwords that comply, and the trend of that share. Illustrative bands are no action above 0.9, improvement expected between 0.8 and 0.9 with a positive trend, and immediate action below 0.8. Evidence is the count in the password database, the compliant count, and the configuration file or policy setting used as the test. It is collected at least yearly, depending on criticality, and reported after each collection. The system administrator owns it and security staff collect.
What it means in practice
Manual password review is a sample, not a census. State the sample, the policy test and the date. The trend matters more than the single percentage, and a rising trend after a training campaign is evidence that the campaign did something.
Status of this record. For B.16, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.
What good looks like
Define the sample, the policy test and the date. Record the count of compliant passwords and the total. Compare with the previous sample. Report the trend and the action for a low result.
Evidence an assessor asks for
- Access controlPassword policy and the compliance count against it
- AuthenticationTrend line over reporting periods
The question an assessor will ask
An assessor will ask for password policy and the compliance count against it. The test for B.16 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.
Common gaps
- Policy enforced technically for new passwords only, with legacy passwords never assessed
- Compliance sampled rather than counted, with no stated sampling basis
Before the next review
Before the next review, test this against one live record: policy enforced technically for new passwords only, with legacy passwords never assessed.
What to check when the revision publishes
When DIS 27004 is published, compare the B.16 Password quality, manual record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.