Companies aiming to achieve ISO 27001 certification should consider adding password management to support identity and access management requirements.