Requirement
"Allocation and management of authentication information shall be controlled by a management process, including advising personnel on appropriate handling of authentication information."[1]
Explanation
Establish procedures for providing user names and passwords to users. For example when resetting a user's password require them to create a new password upon login.
