| 💼 4.1 Have in place a process to create and approve user accounts | | | | |
| 💼 4.2 Authenticate users with unique credentials before granting access to applications or devices | 4 | | | |
| 💼 4.2.1 Passwords are protected against brute-force password guessing | | | | |
| 💼 4.2.2 Use technical controls to manage the quality of passwords. | | 2 | 3 | |
| 💼 4.2.3 Support users to choose unique passwords for their work accounts | | 1 | 1 | |
| 💼 4.2.4 The password element of the multi-factor authentication | | 2 | 3 | |
| 💼 4.3 Remove or disable user accounts when they're no longer required | | | | |
| 💼 4.4 Implement MFA, where available | | | | |
| 💼 4.5 Use separate accounts to perform administrative activities only | | | | |
| 💼 4.6 Remove or disable special access privileges when no longer required | | | | |