The asset owner shall have policies and procedures for managing shared and disclosed/compromised passwords.