Password Manager
What is Password Manager?
Software that securely stores and manages login credentials for various accounts and applications. Password managers generate strong, unique passwords and auto-fill them, reducing the risk of password reuse and weak passwords.
Frameworks that govern password manager
What the standards actually require on password manager
Requirements naming password manager across 4 standards, quoted from the control text.
Credentials stored on systems are protected by a password manager; a hardware security module; or by salting, hashing and stretching them before storage within a database.
ISM-1402 · Credentials stored on systems are protected by a password manager; a hardware security mod →Employ automated mechanisms for the generation, protection, rotation, and management of passwords for systems and accounts not required to use multifactor authentication.
3.5.2e · Password Manager Use →Discoverable credentials (formerly Resident Credentials) per WebAuthn L3 6.3 + CTAP2.1 are credentials whose private-key + per-credential metadata (rpId + userHandle + signCount) are stored on the authenticator.
FIDO2-Passkey-Discoverable · Passkeys (Discoverable Credentials) and Account Recovery →Article 6 + Annex III defines Important PDEs (Class I and Class II) including identity-management systems, password managers, browser plug-ins, operating systems, microcontrollers with security functionality, routers/modems/switches, network management systems...
CRA-Art.6_7 · Important and critical products with digital elements (Articles 6-7) →Questions people ask about password manager
What is Password Manager?
Why is Password Manager important for compliance?
Which compliance frameworks address Password Manager?
Where can I learn more about Password Manager?
See how Password Manager applies across compliance frameworks
Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.