PR.AA-02.199

Does your organization issue unique credentials to each individual user and prohibit credential sharing?

Explanation

Unique credentials ensure accountability and traceability of actions performed within systems, making it possible to identify who accessed what resources and when. Shared credentials create security vulnerabilities as they make it impossible to attribute actions to specific individuals, complicate access revocation when someone leaves, and often lead to weaker password practices. Evidence could include a documented policy prohibiting credential sharing, screenshots of user management systems showing individual accounts for each user, audit logs showing unique user IDs for system access, or documentation of technical controls that prevent credential sharing (such as multi-factor authentication tied to individual devices).

Implementation Example

Issue a different credential for each person (i.e., no credential sharing)

ID: PR.AA-02.199

Context

Function
PR: PROTECT
Category
PR.AA: Identity Management, Authentication, and Access Control
Sub-Category
Identities are proofed and bound to credentials based on the context of interactions

ResponseHub is the product I wish I had when I was a CTO

Previously I was co-founder and CTO of Progression, a VC backed HR-tech startup used by some of the biggest names in tech.

As our sales grew, security questionnaires quickly became one of my biggest pain-points. They were confusing, hard to delegate and arrived like London busses - 3 at a time!

I'm building ResponseHub so that other teams don't have to go through this. Leave the security questionnaires to us so you can get back to closing deals, shipping product and building your team.

Signature
Neil Cameron
Founder, ResponseHub
Neil Cameron