ASD ISM 0383 Change default OS user accounts during setup
What it says
Default user accounts or credentials for operating systems, including for any pre-configured user accounts, are changed, disabled or removed during initial setup.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishChange or disable default OS user accounts during setup to enhance security.
When you first set up a new computer or server, it often comes with a default user account that everyone knows about. If you don't change or remove this account, a hacker can easily break in and take over your system without much effort.
Free. Save your status, tasks and notes.
Why it matters
If default OS accounts/credentials remain unchanged, attackers can guess or reuse known defaults to gain unauthorised access, leading to compromise and data loss.
How to implement
The IT team should identify all default user accounts during initial setup.
They can do this by reviewing the operating system's installation guide or documentation that lists these accounts.
System owners should ensure default passwords for any initial accounts are changed immediately.
They can do this by setting a unique, strong password that includes a mix of letters, numbers, and symbols.
Managers should collaborate with IT to disable unused default accounts.
The IT team can perform this by accessing user account settings and setting accounts that aren't needed to 'disabled' status.
Procurement teams should check with vendors if there's an option to pre-customise operating systems without default accounts.
They can do this by having conversations during the purchasing process to ensure secure system configurations are available.
The IT team should create a checklist for initial system setups that includes removing or disabling all unnecessary default accounts.
This checklist should be reviewed and updated regularly as part of standard procedure.
Keep it running
During build and after major upgrades, confirm all default or pre-configured OS accounts are renamed, disabled or removed, and that any default passwords are changed.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A list of user accounts from the operating system used: Request a document or report showing all current user accounts set up after initial installation.
Look at
Unfamiliar default names such as 'admin' or 'guest'.
Good evidence
No default accounts are active, or their initial credentials have been changed.
- Check 2 of 5What an auditor asks for
Look at
Notes or logs showing actions taken during the setup.
Good evidence
Clearly noted changes or actions with dates and responsible person's name.
- Check 3 of 5What an auditor asks for
Ask for
How they handle default user accounts during new installations.
Look at
Their understanding of the need to change or disable these accounts immediately.
Good evidence
They describe specific actions taken and procedures followed.
- Check 4 of 5What an auditor asks for
Look at
Steps where default accounts are handled.
Good evidence
The IT staff disables or changes default accounts following documented procedure.
- Check 5 of 5What an auditor asks for
Ask for
If there are regular audits or checks in place for the systems post-setup.
Look at
Documentation of when systems were reviewed and any subsequent actions taken.
Good evidence
Regularly scheduled reviews documented with outcomes and actions taken.
Mappings
Closest match in ISO/IEC 27001: A.8.9, Configuration management for secure IT systems, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.9.
ISM-0383 requires default operating system user accounts and credentials (including pre-configured accounts) to be changed, disabled or removed during initial setup. This is a specific hardening action that fits within ISO/IEC 27001:2022 Annex A 8.9's broader requirement to establish, implement, monitor and review secure configurations for IT systems. Annex A 8.9 covers configuration management across many settings and lifecycle activities, while ISM-0383 targets a single high-risk configuration issue at build time.
This control partially overlaps A.5.17.
Annex A 5.17 requires a controlled process for allocating and managing authentication information, including secure handling expectations for credentials. ISM-0383 relates by requiring default operating system accounts or credentials to be changed, disabled or removed during initial setup, which is a key step in managing authentication information to prevent use of known default credentials. ISM-0383 is focused on initial configuration hardening, while Annex A 5.17 covers ongoing lifecycle management and personnel guidance for all authentication information.
ASD Essentials for enterprise IT: 1 mapping
This control partially overlaps IT.PRO-13.1.
IT.PRO-13.1 requires default and unused accounts to be regularly identified and disabled or removed; ISM-0383 requires default operating system accounts or credentials to be changed, disabled or removed during initial setup, addressing the default account part.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.