| 💼 2.1 Computers and network devices | 6 | | | |
| 💼 2.1.1 Remove and disable unnecessary user accounts | | | | |
| 💼 2.1.2 Change any default or guessable account passwords | | 2 | 3 | |
| 💼 2.1.3 Remove or disable unnecessary software | | | | |
| 💼 2.1.4 Disable any auto-run feature which allows file execution without user authorization | | | | |
| 💼 2.1.5 Ensure users are authenticated before allowing them access to organizational data or services | | 3 | 3 | |
| 💼 2.1.6 Ensure appropriate device locking controls for users that are physically present | | | | |
| 💼 2.2 Device unlocking credentials | 3 | | | |
| 💼 2.2.1 A credential such as a biometric, password or PIN must be in place before a user can gain access to the services. | | | | |
| 💼 2.2.2 You must protect your chosen authentication method against brute-force attacks | 2 | | | |
| 💼 2.2.2.1 Shouldn’t allow more than 10 guesses in 5 minutes | | | | |
| 💼 2.2.2.2 Lock devices after more than 10 unsuccessful attempts. | | | | |
| 💼 2.2.3 Technical controls must be used to manage the quality of credentials. | | | | |