8. Credential stored in code, a config file or a script

A credential written into code, a config file, a script or a document is known to everyone who can read that file, and it does not change when people leave.

The rule it applies

The stored-in column reads code, a config file, a script, or a document (a spreadsheet, a wiki, an email or a chat).

A question for the account owner

Can this credential move into a vault, and who has read the file it sits in?

Clauses

3 across the regimes you tick

Regime	Clause	Read on
ISO/IEC 27001	ISO/IEC 27001 A.5.17 Authentication information	every account type
NIST SP 800-53	NIST SP 800-53 IA-5(7) Authenticators: No Embedded Unencrypted Static Authenticators	every account type
PCI DSS	PCI DSS 8.6.2 No hard-coded passwords for interactive system accounts	application and system accounts only

The first clause, set out

ISO/IEC 27001 A.5.17Authentication information

A management process is to control how authentication information is allocated and managed, and it includes telling personnel how to handle such information properly. Purpose (stated in ISO/IEC 27002:2022): ensures proper entity authentication and prevents authentication process failures. As an Annex A reference control, it is compared with the controls determined in risk treatment (6.1.3 c) and recorded in the Statement of Applicability as included or excluded, with the justification and implementation status (6.1.3 d); implementation guidance is ISO/IEC 27002:2022 5.17.

What an auditor asks to see: Statement of Applicability entry for control A.5.17, showing inclusion or justified exclusion, implementation status and the risks it treats; Credential issuance procedure requiring identity verification before new, replacement or temporary credentials are provided; Evidence that initial credentials are unique, delivered over protected channels and changed at first use; Password policy and technical configuration showing length, complexity, reuse prevention, breached-password blocking and masked entry; Records of vendor default credentials being changed at installation

Where account lists usually fall short: Initial passwords are sent in clear text email or use a predictable pattern; Default vendor credentials remain on network devices or appliances; Shared account passwords are not changed when someone who knew them leaves; No check against known breached passwords is performed

Source: ISO/IEC 27001:2022 Annex A

See it on the specimen All fourteen findings