[Autogenerated] after the complexity of the previous three requirements.
Requirement 8.4 is a simple one,
and it is to make sure that your users know the rules
about identification authentication,
which you're typically include in your awareness training and in
your organization's acceptable use policies.
The requirement is actually quite prescriptive and wants to make
sure that however you communicate to users,
they're told how to select strong passwords or pass phrases.
They're told how they should be protected,
for example, by not writing them down.
They're told that they shouldn't be reused,
and they're also told to change your password that the
user things may no longer be a secret.
The testing procedure here can catch you out because that's what is
reviewing the training or documentation provided to users.
The que SE will pick a random sample of people with access to the card,
all the data environment and ask them questions about
keeping the authentication credential secure.
So most organizations will make sure that the random people
the Q SATA is may meet when they're testing.
This requirement will know the correct answer