Skip to content
System access
ASD ISMISM-0417

ASD ISM 0417 Use passwords when multi-factor authentication isn't supported

What it says

When systems cannot support multi-factor authentication, single-factor authentication using passwords is implemented instead.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

If systems can't use multi-factor authentication, they should use passwords for single-factor authentication.

There are times when certain systems can't use stronger security measures like multi-factor authentication (MFA), which usually involves a second step like a text message code, to protect access. In such cases, we rely on passwords alone. It's crucial to ensure these passwords are strong and well-managed because, without good password practices, there is a greater risk of unauthorised access to sensitive information.

Why it matters

If MFA is unavailable and strong password-only authentication is not enforced, attackers can gain unauthorised access and expose sensitive information.

How to implement

  1. System owners should assess if any system cannot support multi-factor authentication.

    To do this, check system specifications or consult with the vendor to clarify if MFA can be enabled.

  2. IT teams should enforce strong password policies for systems limited to passwords only.

    This includes setting rules about password length, complexity, and regular updates.

  3. Office managers or HR personnel should conduct regular training sessions on creating and maintaining strong passwords.

    This will help ensure employees understand the importance of password security.

  4. Procurement teams should be involved when acquiring new systems.

    They need to confirm during the purchase process if the system supports multi-factor authentication, avoiding systems that only allow password protection unless absolutely necessary.

  5. The IT team should implement a password management tool to help users securely store and manage their passwords.

    Select a tool that securely encrypts passwords and is user-friendly to encourage its use.

Keep it running

Where MFA cannot be used, enforce strong password-only authentication: length/complexity, deny common passwords, and set lockout/rate-limits to reduce guessing.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The list of systems without multi-factor authentication capability.

    Look at

    The list to ensure that all such systems are clearly identified.

    Good evidence

    Includes a complete record with evidence these systems were assessed for MFA support.

  2. Check 2 of 5What an auditor asks for

    Good evidence

    Shows all users must use strong passwords, with clear rules that are easy to understand.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Employees if they received training on password creation and management.

    Good evidence

    Is that they recall attending training and describe the key points emphasised regarding password security.

  4. Check 4 of 5What an auditor asks for

    Good evidence

    Is that users can demonstrate the tool's use and discuss its features, reflecting its integration into daily routines.

  5. Check 5 of 5What an auditor asks for

    Good evidence

    Includes evidence of acceptance criteria mandating MFA or reasons documented why exceptions were made.

Mappings

Closest match in ISO/IEC 27001: A.8.5, Secure authentication technologies and procedures, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.8.5Secure authentication technologies and proceduresPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.