Orphaned Account Checker

6. Password or key not changed within the period, or never

A credential that is never changed stays usable for as long as anyone who ever knew it. The period is the one you set; with PCI DSS ticked, a person's password used alone reads against the 90 days of 8.3.9, and a system account against your targeted risk analysis under 8.6.3.

The rule it applies

The last changed date is more than the period you set (default 365 days) before the as-at date, or the list says never. With PCI DSS ticked, a user account whose MFA does not read yes also fires at more than 90 days (8.3.9); with MFA not recorded that line is a question. For a system account under PCI DSS 8.6.3 the period is your targeted risk analysis, and the one you set stands in for it.

A question for the account owner

When was this credential last changed, and who knows it?

Clauses

6 across the regimes you tick
RegimeClauseRead on
ISO/IEC 27001ISO/IEC 27001 A.5.17 Authentication informationevery account type
NIST SP 800-53NIST SP 800-53 IA-5 Authenticator Managementevery account type
PCI DSSPCI DSS 8.3.9 Single-factor passwords changed every 90 days or dynamic analysisuser accounts whose MFA does not read yes
ISO/IEC 27001ISO/IEC 27001 A.8.5 Secure authenticationuser accounts whose MFA does not read yes
NIS2NIS2 Art. 21(2)(j) Multi-factor or continuous authentication, secured communications and secured emergency communicationsuser accounts whose MFA does not read yes
PCI DSSPCI DSS 8.6.3 System account passwords protected against misuseapplication and system accounts only

The first clause, set out

ISO/IEC 27001 A.5.17Authentication information

A management process is to control how authentication information is allocated and managed, and it includes telling personnel how to handle such information properly. Purpose (stated in ISO/IEC 27002:2022): ensures proper entity authentication and prevents authentication process failures. As an Annex A reference control, it is compared with the controls determined in risk treatment (6.1.3 c) and recorded in the Statement of Applicability as included or excluded, with the justification and implementation status (6.1.3 d); implementation guidance is ISO/IEC 27002:2022 5.17.

What an auditor asks to see: Statement of Applicability entry for control A.5.17, showing inclusion or justified exclusion, implementation status and the risks it treats; Credential issuance procedure requiring identity verification before new, replacement or temporary credentials are provided; Evidence that initial credentials are unique, delivered over protected channels and changed at first use; Password policy and technical configuration showing length, complexity, reuse prevention, breached-password blocking and masked entry; Records of vendor default credentials being changed at installation
Where account lists usually fall short: Initial passwords are sent in clear text email or use a predictable pattern; Default vendor credentials remain on network devices or appliances; Shared account passwords are not changed when someone who knew them leaves; No check against known breached passwords is performed
Source: ISO/IEC 27001:2022 Annex A

See it on the specimenAll fourteen findings