What does ISO 27001 require for sharing authentication data?
ISO 27001 and access management
ISO 27001 is built around a risk-based approach to information security. It doesn't prescribe specific technologies but requires that organisations identify risks, implement controls, and demonstrate that those controls are effective.
Annex A of ISO 27001:2022 contains a set of reference controls. Several of these apply directly to credential management and sharing:
A.5.17 — Authentication information This control requires that the allocation and management of authentication information be controlled. Specifically, it addresses how authentication credentials are assigned, communicated, and changed. The standard requires that secret authentication information is communicated to users through secure means.
A.8.2 — Privileged access rights Privileged credentials (admin accounts, root access, etc.) require tighter controls than standard user credentials, including restrictions on who can hold them and how they are managed.
A.8.5 — Secure authentication Authentication procedures must be appropriate to the sensitivity of the information being accessed.
What "communicated through secure means" means
The phrase "communicated through secure means" in A.5.17 is the key requirement for credential sharing. It rules out plain email and unencrypted messaging channels for sharing authentication data. It implies:
- The transmission should be encrypted
- The credential should not be accessible to anyone other than the intended recipient
- There should be a mechanism to verify receipt by the correct person
A one-time encrypted link satisfies these requirements in a way that a plaintext email does not. The credential is encrypted at rest, decrypted only at the moment of retrieval, delivered exactly once to whoever holds the link, and then deleted.
Evidence and documentation requirements
ISO 27001 certification requires not just that controls exist but that their operation can be evidenced. For credential sharing, this means being able to demonstrate:
- That a secure method was used for credential delivery
- Who received access to which systems and when
- That access was revoked when no longer needed
- That privileged credentials are subject to additional oversight
A consistent practice of using PassTransfer for credential delivery, combined with a log of sharing events, creates an evidence trail that supports ISO 27001 audits. Ad-hoc sharing via informal channels leaves gaps that an auditor will identify.
The risk assessment angle
ISO 27001 requires you to assess and treat information security risks. Careless credential sharing is a documented risk vector — it features prominently in breach statistics and threat intelligence. If your risk assessment identifies it as a risk (and it should), your treatment plan needs to address it with a control. Using a secure credential delivery tool is a straightforward, documented control that maps directly to the risk.
Practical steps for ISO 27001 alignment
-
Define a credential management policy that specifies how authentication data is to be shared. Reference the requirement for secure transmission channels.
-
Select a tool that meets the security requirements — encryption at rest and in transit, single-use delivery, automatic expiry. PassTransfer meets these criteria.
-
Train staff on the policy and the tool. Document the training.
-
Maintain records of credential sharing events, especially for privileged accounts.
-
Review and rotate credentials on a defined schedule and after personnel changes.
Conclusion
ISO 27001 creates clear expectations for how authentication data is handled and communicated. The standard's requirement for "secure means" of credential communication is not satisfied by plain email or informal messaging. An encrypted one-time link service provides a documented, auditable approach that aligns with the standard's intent and supports the evidence requirements of certification audits.
