Essential Eight RA-ML2.5 Long, unique, and managed credentials for admin accounts
What it says
Credentials for break glass accounts, local administrator accounts and service accounts are long, unique, unpredictable and managed.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure admin account credentials are strong, unique, and well-managed.
This control is all about making sure that the passwords or keys admin accounts use are really hard to guess or crack. If these passwords are weak or reused across systems, someone trying to break in could take over your entire network. Think of it like having a super strong lock on the most important door to your house.
Free. Save your status, tasks and notes.
Why it matters
Weak or shared admin credentials let attackers brute-force or reuse passwords to gain privileged access, move laterally, and rapidly compromise critical systems.
How to implement
The IT team should generate strong passwords for admin accounts.
Use a password manager to create and store passwords that are at least 15 characters long and include a mix of letters, numbers, and symbols.
The system administrator should regularly update admin account credentials.
Set a schedule to change passwords every six months to ensure they stay secure and up-to-date.
The security officer should ensure credentials are unique and not reused across multiple accounts.
Use a unique password for each admin account to reduce the risk of a breach affecting multiple areas.
The IT team should manage service account credentials through automated tools.
Implement tools like a password vault to securely manage and rotate service account passwords automatically.
The IT department should monitor 'break glass' account access.
Set up alerts and logging to track the use of these emergency accounts to ensure they are used appropriately.
Keep it running
Audit break glass, local admin and service account credentials for length, uniqueness and rotation; store in an approved password vault and disable shared/reused passwords.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
How does the organisation ensure that admin passwords are long and unique?
Look at
Request to see documentation on password policies and evidence of password manager tools in use.
Good evidence
Password policy documents establish minimum length and complexity for admin passwords, and a password manager is used to ensure uniqueness.
- Check 2 of 2What an auditor asks for
Ask for
How often are admin passwords updated?
Look at
Examine logged password change records and policies regarding the frequency of password updates.
Good evidence
Password change records show updates every six months as required by policy.
Mappings
Closest match in ASD Information Security Manual: ISM-1685, Strengthening passwords for critical accounts, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially overlaps A.5.17.
Annex A 5.17 requires a controlled process for allocating and managing authentication information, including how credentials are handled by personnel and systems. E8-RA-ML2.5 relates by requiring administrator, service and break glass account credentials to be long, unique, unpredictable and managed, which is a targeted credential management requirement. E8-RA-ML2.5 is scoped to high-risk account types and credential quality/management, while Annex A 5.17 applies more generally to authentication information management across the organisation.
ASD Information Security Manual: 18 mappings
This control is equivalent to ISM-1685.
E8-RA-ML2.5 requires credentials for break glass accounts, local administrator accounts and service accounts to be long, unique, unpredictable and managed. ISM-1685 states the same requirement for the same account types and the same strength/management characteristics. Implementing E8-RA-ML2.5 would largely satisfy ISM-1685 and vice versa.
This control is equivalent to ISM-1954.
ISM-1954 requires credentials for built-in Administrator, break glass, local administrator and service accounts to be randomly generated. E8-RA-ML2.5 requires those same account types to use long, unique, unpredictable, managed credentials, which in practice is achieved by random generation and managed storage/rotation. E8-RA-ML2.5 adds explicit strength/management characteristics (long and managed), while ISM-1954 is specifically framed as random generation.
This control is broader than ISM-1619.
ISM-1619 requires service accounts to be created as gMSAs so their credentials are system-managed rather than manually set and reused. E8-RA-ML2.5 requires service account (and other admin) credentials to be long, unique, unpredictable and managed, which gMSAs directly help achieve through automatic password management and rotation. ISM-1619 does not by itself define all credential policy requirements (e.g. break glass handling), but it materially strengthens meeting E8-RA-ML2.5 for service accounts.
This control is broader than ISM-1953.
E8-RA-ML2.5 requires credentials for break glass accounts, local administrator accounts and service accounts to be long, unique, unpredictable and managed. ISM-1953 aligns to this intent but is limited to the built-in Administrator account in each domain, specifying strong management of those credentials. The primary control covers a wider set of privileged account types than ISM-1953.
This control partially overlaps ISM-1227.
ISM-1227 requires credentials set for user accounts to be randomly generated to improve password unpredictability. This supports E8-RA-ML2.5 because random generation is a practical means of achieving "unique" and "unpredictable" credentials for high-value accounts (e.g. break glass, local administrator and service accounts). E8-RA-ML2.5 is broader as it also requires sufficient length and active management of those credentials, not just randomness at creation.
- ISM-1590Changing user account credentials after compromise, exposure or shared membership changePartially overlaps
This control partially overlaps ISM-1590.
ISM-1590 requires credentials to be changed when they are compromised/suspected compromised, exposed in the clear, or when shared account membership changes. E8-RA-ML2.5 requires administrator, service, and break glass account credentials to be long, unique, unpredictable and managed. They overlap in credential governance for high-value accounts, but ISM-1590 is primarily about rotation/reset on specific triggers, while E8-RA-ML2.5 is about credential strength and ongoing management irrespective of compromise events.
This control partially overlaps ISM-1612.
ISM-1612 requires that break glass accounts are only used for specific authorised activities (i.e., emergency-only use with explicit authorisation). This overlaps with E8-RA-ML2.5 because it also targets break glass accounts, requiring their credentials to be long, unique, unpredictable, and managed to reduce the likelihood of unauthorised use. ISM-1612 primarily constrains when/why the account may be used, while E8-RA-ML2.5 primarily constrains how the account is protected (credential strength and management).
This control partially overlaps ISM-1614.
ISM-1614 requires break glass account credentials to be changed by the account custodian after emergency access by any other party. E8-RA-ML2.5 relates by setting baseline strength and management expectations for break glass credentials, which aligns with the credentials ISM-1614 requires to be rotated after use.
This control partially overlaps ISM-1795.
E8-RA-ML2.5 requires credentials for break glass, local administrator, and service accounts to be long, unique, unpredictable, and managed. ISM-1795 supports the 'long' aspect by prescribing a specific minimum length (30 characters) for these accounts. E8-RA-ML2.5 is broader as it also requires uniqueness, unpredictability, and managed handling, whereas ISM-1795 focuses on password length.
This control partially overlaps ISM-1842.
ISM-1842 requires dedicated privileged service accounts to add machines to the domain, reducing exposure from using standard or personal admin accounts for domain join. E8-RA-ML2.5 requires strong, unique, managed credentials for service accounts (and other admin accounts), which directly strengthens the security of the domain-join service account mandated by ISM-1842. ISM-1842 focuses on account purpose separation for a specific task, while E8-RA-ML2.5 focuses on credential quality and management for those accounts.
This control partially overlaps ISM-1847.
ISM-1847 requires organisations to change the KRBTGT service account credentials twice (with replication between changes) when compromise is suspected/confirmed or if not changed in the last 12 months. E8-RA-ML2.5 relates by requiring long, unique, unpredictable and managed credentials for service accounts (which includes KRBTGT as a type of service account), improving the strength and management of those credentials. However, E8-RA-ML2.5 does not mandate KRBTGT-specific rotation timing/sequence, while ISM-1847 does not fully cover the broader Essential Eight requirement across all break glass, local admin and service accounts.
This control partially overlaps ISM-1949.
ISM-1949 requires AD FS administration to occur via a dedicated account that is not used to administer other systems. E8-RA-ML2.5 relates by requiring strong, unique, managed credentials for service and administrator accounts, which strengthens the security of any dedicated AD FS admin/service account. However, E8-RA-ML2.5 focuses on credential quality and management, whereas ISM-1949 focuses on account separation and non-reuse for AD FS administration.
This control partially overlaps ISM-2142.
ISM-2142 requires static credentials used by applications and workloads to be centrally managed using a credential/secrets management solution. This overlaps with E8-RA-ML2.5 because centrally managed secrets is a practical way to ensure service account (and similar non-human) credentials are managed, unique and rotated rather than hard-coded or reused. However, E8-RA-ML2.5 also covers break glass and local administrator accounts (human/admin use cases) and emphasises credential strength/uniqueness, while ISM-2142 is specifically about centralised management for application/workload static credentials.
- ISM-2144Change application static credentials found compromised or exposed in clearPartially overlaps
This control partially overlaps ISM-2144.
ISM-2144 requires static credentials used by applications and workloads to be changed when they are compromised/suspected of being compromised, or found stored or transmitted in the clear. E8-RA-ML2.5 relates by requiring service account credentials to be long, unique, and managed, reducing exposure risk and supporting rotation practices. ISM-2144 is condition-triggered, while E8-RA-ML2.5 is a preventative measure.
This control depends on ISM-1615.
E8-RA-ML2.5 requires break glass, local administrator and service account credentials to be long, unique, unpredictable and managed. ISM-1615 strengthens that management requirement by ensuring break glass accounts are tested after credential changes, reducing the risk of unusable emergency access. ISM-1615 does not set credential strength/uniqueness requirements, but it supports operational assurance around the primary control's management intent.
This control depends on ISM-1829.
ISM-1829 requires that passwords are not stored in Group Policy Preferences, where they are recoverable by any domain user and have historically been used to set shared local administrator passwords. Removing this practice supports E8-RA-ML2.5, which requires break glass, local administrator and service account credentials to be long, unique, unpredictable and managed. E8-RA-ML2.5 sets broader credential quality and management requirements, whereas ISM-1829 removes one insecure storage method.
This control depends on ISM-1875.
ISM-1875 requires monthly scanning to detect credentials stored in the clear so they can be remediated. E8-RA-ML2.5 requires admin-related credentials (break glass, local admin, service accounts) to be long, unique, unpredictable and managed, which reduces the likelihood and impact of any credentials discovered by ISM-1875 being reused or weak. The controls address different layers: ISM-1875 is discovery/detection of improper storage, while E8-RA-ML2.5 is credential strength and management for privileged accounts.
This control depends on ISM-2081.
ISM-2081 requires that all ASCII printable characters are supported for passwords, enabling stronger and more flexible password construction. E8-RA-ML2.5 requires credentials for high-risk administrative accounts to be long, unique, unpredictable, and managed, which depends on credential systems being able to represent strong secrets without restrictive character limitations. ISM-2081 strengthens E8-RA-ML2.5 by ensuring password complexity is not artificially constrained, though E8-RA-ML2.5 also covers management practices beyond character support.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-13.6Enforce unique credentials per system and account, especially in high-privilege contextsPartially overlaps
This control partially overlaps IT.PRO-13.6.
IT.PRO-13.6 requires user, machine, system and service account credentials to be unique per system or account, especially where privileged; E8-RA-ML2.5 requires break glass, local administrator and service account credentials to be long, unique, unpredictable and managed, a specific case of that.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.