Passwords are always cryptographically protected — never plain text.
What it actually means
Passwords must be hashed at rest and protected (TLS) in transit — never stored or sent in plain text. A managed identity provider does this automatically; the risk is almost always a homegrown app, script, spreadsheet, or config file holding credentials in the clear.
Pass or fail — an assessor needs a "yes" to each
- Passwords are salted-hashed in storage (handled by the identity provider).
- Passwords are transmitted only over TLS.
- No plaintext passwords in apps, scripts, configs, or spreadsheets.
What to have ready
- Identity-provider documentation of hashing
- Confirmation that custom apps don't store plaintext credentials
- Secrets-management approach for any service credentials
Where teams trip up
- Credentials hardcoded in scripts or config files
- A spreadsheet or doc of shared passwords
- Internal apps storing passwords reversibly
See where this control puts your score
Run all 110 requirements free in about 10 minutes — or draft your SSP language for this control. No signup.
Calculate your SPRS score →Draft your SSP language →Connected requirements
More in Identification & Authentication (3.5)
3.5.1 — Uniquely identify users, processes, and devices3.5.2 — Authenticate before access3.5.3 — Multifactor authentication (MFA)3.5.4 — Replay-resistant authentication3.5.5 — Don't recycle identifiers3.5.6 — Disable dormant accounts3.5.7 — Enforce password complexity3.5.8 — Block password reuse3.5.9 — Force change of temporary passwords3.5.11 — Obscure authentication feedback