Skip to content

Password Manager

What is Password Manager?

Software that securely stores and manages login credentials for various accounts and applications. Password managers generate strong, unique passwords and auto-fill them, reducing the risk of password reuse and weak passwords.

Information Security

Frameworks that govern password manager

ISO 27001:2022View framework →NIST SP 800-53 Rev 5View framework →

What the standards actually require on password manager

Requirements naming password manager across 6 standards, quoted from the control text.

New Zealand Information Security Manual (NZISM)2 controls

Agencies that use password managers should consider requiring MFA to gain access to the password manager.

new-zealand-information-security-manual-nzism::16.1.37.C.02 · 16.1.37.C.02 Consider MFA for password manager access →
NIST SP 800-1721 control

Employ automated mechanisms for the generation, protection, rotation, and management of passwords for systems and accounts not required to use multifactor authentication.

3.5.2e · Password Manager Use →
NIST SP 800-53 Rev 51 control

(a) Employ [Assignment: organization-defined password managers] to generate and manage passwords; and (b) Protect the passwords using [Assignment: organization-defined controls].

NIST800-IA-5(18) · IA-5(18) Authenticator Management | Password Managers →
FIDO2 / WebAuthn2 controls

Discoverable credentials (formerly Resident Credentials) per WebAuthn L3 6.3 + CTAP2.1 are credentials whose private-key + per-credential metadata (rpId + userHandle + signCount) are stored on the authenticator.

FIDO2-Passkey-Discoverable · Passkeys (Discoverable Credentials) and Account Recovery →
Australian Information Security Manual1 control

Credentials stored on systems are protected by a password manager; a hardware security module; or by salting, hashing and stretching them before storage within a database.

ISM-1402 · Protecting stored credentials →
WCAG 2.21 control

No authentication step requires a cognitive function test (for example recalling a password or solving a puzzle) unless the step offers an alternative method without one, a mechanism to help complete it (for example password-manager paste support), or the test...

wcag-22::3.3.8 · Accessible Authentication (Minimum) (Level AA) →

Questions people ask about password manager

What is Password Manager?
Software that securely stores and manages login credentials for various accounts and applications. Password managers generate strong, unique passwords and auto-fill them, reducing the risk of password reuse and weak passwords.
Why is Password Manager important for compliance?
Password Manager is a key concept in Information Security. Understanding password manager helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 1,016 frameworks with 316K cross-framework control mappings.
Which compliance frameworks address Password Manager?
Password Manager appears in the requirement text of New Zealand Information Security Manual (NZISM), NIST SP 800-172, NIST SP 800-53 Rev 5, FIDO2 / WebAuthn, Australian Information Security Manual. Across these standards we have identified 8 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Password Manager?
Explore our compliance framework pages to see how password manager applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 1,016 frameworks.

See how Password Manager applies across compliance frameworks

Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.