Why it matters
Passwords and secrets are still the most common initial access vector in real breaches.
How a self-led small team implements it
A password manager plus MFA on anything that matters covers this for a small team — don't overbuild a rotation policy nobody follows.
What auditors expect to see
Password policy, MFA enforcement screenshot.
Track A.5.17 in your own Statement of Applicability — mark it applicable, log your justification, and link it to the risk that drove it.
Start your ISMS