What does the checker look for on a built-in or vendor default account?

It reads the lines of your export and raises, where the columns support it: 2. owner has left, or owner not recognised; 3. no owner named, or a team named with no accountable person; 4. dormant for more than the threshold; 5. privileged, and orphaned or dormant; 6. password or key not changed within the period, or never; 8. credential stored in code, a config file or a script; 10. not reviewed within the interval; 13. vendor default or built-in account enabled. Each finding is a question for the account owner or the reviewer.

Account types

Built-in or vendor default account

The team that runs the system names one person who answers for it; a built-in account nobody uses is switched off or its default password changed.

Who should own a built-in or vendor default account, and which ISO/IEC 27001, SOC 2 and PCI DSS clauses apply?

The clauses the checker cites on a built-in or vendor default account: ISO/IEC 27001 A.5.17, ISO/IEC 27001 A.8.2 and PCI DSS 2.2.2. Every clause it cites, across the seven regimes, is in the table below.

How the checker reads it

It is an application or system account: PCI DSS reads it under 7.2.5, 7.2.5.1 and 8.6.1 to 8.6.3, never under the user-account periods.
It needs a named person as owner; a blank owner, a team or a mailbox is finding 3, and an owner who has left by the staff list is finding 2.
The type comes from your type column; when that is blank the checker reads the account name and labels the type assumed from the name, and any finding resting on it is read as a question by the reviewer.
The name is a whole account name such as admin, root, sa or guest; a longer name that contains one of those words is read by its other words.

Findings that can apply

8 of 14

2. Owner has left, or owner not recognised: Who owns this account now, and should it still exist?
3. No owner named, or a team named with no accountable person: Which one person is accountable for this account and can say what it is for?
4. Dormant for more than the threshold: Is this account still needed, and if so by whom?
5. Privileged, and orphaned or dormant: Who holds these rights today, and do they still need them?
6. Password or key not changed within the period, or never: When was this credential last changed, and who knows it?
8. Credential stored in code, a config file or a script: Can this credential move into a vault, and who has read the file it sits in?
10. Not reviewed within the interval: Who reviews this account, and when is the next review due?
13. Vendor default or built-in account enabled: Is this default account used, and if so has its default password been changed?

Clauses

5 cited

Regime	Clause
ISO/IEC 27001	ISO/IEC 27001 A.5.17 Authentication information
ISO/IEC 27001	ISO/IEC 27001 A.8.2 Privileged access rights
PCI DSS	PCI DSS 2.2.2 Vendor default accounts managed
NIST SP 800-53	NIST SP 800-53 IA-5 Authenticator Management
CIS Controls	CIS Controls 5.1 Establish and Maintain an Inventory of Accounts

The first clause, set out

ISO/IEC 27001 A.5.17Authentication information

A management process is to control how authentication information is allocated and managed, and it includes telling personnel how to handle such information properly. Purpose (stated in ISO/IEC 27002:2022): ensures proper entity authentication and prevents authentication process failures. As an Annex A reference control, it is compared with the controls determined in risk treatment (6.1.3 c) and recorded in the Statement of Applicability as included or excluded, with the justification and implementation status (6.1.3 d); implementation guidance is ISO/IEC 27002:2022 5.17.

What an auditor asks to see: Statement of Applicability entry for control A.5.17, showing inclusion or justified exclusion, implementation status and the risks it treats; Credential issuance procedure requiring identity verification before new, replacement or temporary credentials are provided; Evidence that initial credentials are unique, delivered over protected channels and changed at first use; Password policy and technical configuration showing length, complexity, reuse prevention, breached-password blocking and masked entry; Records of vendor default credentials being changed at installation

Where account lists usually fall short: Initial passwords are sent in clear text email or use a predictable pattern; Default vendor credentials remain on network devices or appliances; Shared account passwords are not changed when someone who knew them leaves; No check against known breached passwords is performed

Source: ISO/IEC 27001:2022 Annex A

A line that reads as this type

the type column left blank, invented values

admin | | directory | | yes

See the specimen run