IA.2.085 — Store and transmit only cryptographically-protected passwords

What IA.2.085 means in plain English

Passwords must never be stored in plain text (like in a spreadsheet or a text file) or sent across the network unencrypted. Properly protected means the password is "hashed" — converted into a scrambled one-way code using an algorithm like bcrypt or PBKDF2, so even if the database is stolen, the actual passwords cannot be recovered. Transmission protection means passwords are only ever sent over HTTPS/TLS connections, never over HTTP, plain FTP, or unencrypted email. For your team: use a password manager (never a spreadsheet), ensure all services use HTTPS, and never email passwords in plain text.

The assessment question

“Are all passwords stored exclusively in cryptographically hashed form (not plaintext or reversibly encrypted) — and are all password transmissions protected by TLS 1.2 or higher?”

How to implement IA.2.085

1. Immediately audit whether any passwords are stored in plain text: check shared drives, SharePoint, OneNote, email threads, and sticky notes. Delete or replace any found.
2. Migrate all password storage to Bitwarden Teams or Microsoft 365 Password Manager — both use AES-256 encryption and PBKDF2 hashing for storage.
3. For any custom web applications or databases your company operates, verify the developer used bcrypt, Argon2, or PBKDF2 for password hashing — never MD5 or SHA-1 alone.
4. Force HTTPS-only on any web services or applications you manage: configure HSTS headers and redirect all HTTP traffic to HTTPS.
5. Confirm all remote access tools (VPN, RDP gateway, web portals) use TLS 1.2 or 1.3 — use IIS Crypto or SSL Labs to verify.

Evidence your assessor will ask for

• Password manager enrollment showing all users storing credentials in the vault
• SSL Labs test results showing A or A+ rating for all web services
• Attestation that no plain-text password files exist (with evidence of audit)
• TLS configuration screenshot for VPN and RDP gateway endpoints
• System Security Plan section documenting password storage and transmission protection mechanisms

More Identification & Authentication controls