This policy procedure sets out how passwords and other secret authentication details are allocated, protected and withdrawn, and what each user must do to keep them safe.

Effective Policy Templates

This policy template is supplied in fully editable MS Word format and can be easily customised and edited. The document uses pre-defined style formatting throughout, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:

• Policy number and title
• Information-classification
• Version
• Page number / total pages

alphaZ documents - beautifully designed, tried and tested policy templates. No junk, jargon or unnecessary content. Simple and usable policy templates developed over 25 years through practical use in the real world.

Further Reading

Further guidance on user authentication:

• ISO 27001 Annex A 8.5 - Secure Authentication
• Access Control, Passwords and User Authentication
• ISO 27001 Annex A 5.17 - Authentication Information
• Information Security knowledge base

Logo Update Service

Download this policy with your company name and logo already added!
Document Preparation is included with the alphaZ subscription.

How to Download

This file is included in the alphaZ subscription.

Need Help Implementing?

If you'd like hands-on help setting up user logins, password controls and leaver steps, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.

User Secret Authentication Policy Procedure Template

The User Secret Authentication Policy Procedure is a Word template that sets out how a business manages and protects passwords, codes and other secret authentication information. It covers what secret authentication is, the controls every IT system enforces, allocation of access rights and unique logins, removing access when staff leave, user responsibilities and the consequences of a breach.

It applies to all employees and company activities, with breaches open to the disciplinary procedure. The file has Title, File Location, Issue No, Issue Date, Controlled By and Approved By fields, an Amendment Record and a Business Use information classification in the footer.

What the Policy Covers

• Amendment record, summary, scope and applicability - the purpose of managing and protecting secret authentication information, the activities and staff covered, and disciplinary action for breaches
• What secret authentication is - passwords, secret codes and characters from a secret word, used to confirm a person is who they claim to be
• Management of secret authentication - system controls for individual user authentication, protected password retrieval, user level logging, role management and auditable password administration
• Allocation of secret authentication - access rights relevant to each role, unique logins and passwords, regular access reviews and admin accounts only for those who need them
• User de-registration - access suspended at close of business on a leaver's last working day, requested by their manager through the IT Department
• User responsibilities and compliance - locking unattended computers, leaving no login details on display, reporting role changes and compromised passwords, and disciplinary action for breaches

Built for Unique User Logins

• No generic accounts, with every user authenticated individually on company IT systems
• System access monitored and logged at user level
• Access suspended at close of business on a leaver's last working day
• System administration accounts limited to users who perform administration tasks
• Users report straight away any concern that a password has been compromised

Who Needs a User Secret Authentication Policy Procedure?

Any business where staff log in to company systems with their own credentials, and the managers and IT staff who set up and remove access.

Using the Policy

Edit the system controls, the access review interval and the leaver process to match your own IT arrangements, and name the person in the Controlled By field. Give it top level approval and brief all users on their responsibilities.

Related Documents

GG-8-04 Access Control and User Authentication Guidance and TT-8-04 Access Control and User Authentication Training Talk help managers and staff put password and login controls into practice.

When a Breach Becomes a Criminal Matter

The policy compliance section makes clear that a user found to have breached the policy may face the disciplinary procedure, and that where a criminal offence is considered to have been committed, further action may be taken to assist in the prosecution of the offender.