Article 12 Password control
United Kingdom
1.
All passwords shall be kept safely and treated confidentially. In case of suspicion that a password has been disclosed, the password has to be changed immediately or the relevant account has to be disabled. Unique and individual user identities shall be used.
2.
Procedures shall be defined in the Security Policy for logging in and out to prevent any unauthorised access.