Skip to content
Overlap

Habit 09 of 18
Accounts and access

A shared password manager

Staff keep passwords in a password manager instead of reusing them.

Reused passwords are how one breach becomes many. A password manager makes unique passwords painless.

Switch it on in the map Counts towards 4 articles, controls and categories

§1 How to do it

How a small firm does it

  1. Choose one business password manager for everyone.
  2. Use it to share passwords instead of email or chat.
  3. Ask staff to replace reused passwords, starting with email and banking.
  4. Remove leavers from it on their last day.

Evidence that shows it

  • The password manager's admin view showing who has access
  • Your policy line that requires it

Ireland: NCSC Ireland guidance on authentication applies here. Irish NIS2 law is still pending.

§2 What it counts towards

What it counts towards

Most links are “supports”: doing this helps you show you meet the reference, without matching it exactly. None of them means “compliant”.

EU NIS2 Directive 2 items

  • 21(2)(g) Basic cyber hygiene and training · supports

    basic cyber hygiene practices and cybersecurity training

    The recitals list password practices among basic cyber hygiene (recital 49). A password manager is a practical way to follow them.

    Read Art 21(2)(g) on EUR-Lex

  • 21(2)(i) People security, access control and assets · supports

    human resources security, access control policies and asset management

    Access control is named in this measure. The Commission’s implementing rules for it include authentication and managing passwords (2024/2690, Annex §11.6).

    Read Art 21(2)(i) on EUR-Lex

ISO/IEC 27001:2022 1 item

  • A.5.17 Looking after passwords and other secrets · supports

    ISO text is copyrighted. Control number and our own description only. Not yet read against the standard.

    The control is about handing out and looking after passwords and other secrets.

    About ISO/IEC 27001:2022 on ISO

NIST Cybersecurity Framework 2.0 1 item

  • PR.AA Identity and access · supports

    PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization

    A password manager is one way to manage the credentials people use to sign in.

    Read PR.AA-01 on NIST

Indicative mapping, written by hand from public sources. Not legal advice and not a compliance test. Check anything important against the official texts.