ASD ISM 0421 Require minimum 15-character passwords for security
What it says
Passwords used for single-factor authentication on non-classified, OFFICIAL: Sensitive and PROTECTED systems are a minimum of 15 characters.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishPasswords for sensitive systems must have at least 15 characters to enhance security.
This control requires that all passwords used to access sensitive systems must be at least 15 characters long. It's important because longer passwords are harder for attackers to guess or break, making it much harder for them to gain unauthorised access to your important systems.
Free. Save your status, tasks and notes.
Why it matters
Using passwords under 15 characters makes brute-force and guessing attacks more feasible, increasing the likelihood of unauthorised access and compromise of OFFICIAL: Sensitive or PROTECTED data.
How to implement
System owners should review and update password policies to enforce a minimum length of 15 characters.
They can do this by adjusting the settings in their user management or authentication systems to require passwords of this length.
IT teams should educate staff about the importance of strong passwords.
They can conduct short workshops or send out instructional emails explaining how to create a memorable yet secure 15-character password using phrases or a combination of unrelated words.
Managers should ensure that any software or applications used by the organisation are configured to support and enforce 15-character passwords.
This involves checking application settings and making necessary adjustments or coordinating with software vendors for support.
HR and administrative staff should include password length policies in onboarding materials for new hires.
This can be done by adding these guidelines to employee handbooks and ensuring new employees receive a briefing during their initial training.
Procurement teams should liaise with IT when purchasing new systems to ensure they are capable of enforcing the 15-character password policy.
This means verifying that vendors can meet this requirement before finalising any purchase agreements.
Keep it running
Set systems to enforce a minimum 15-character password for single-factor logons, brief staff on creating long memorable passphrases, and promote password managers to reduce reuse and weak choices.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The organisation's password policy document. Look to see if it specifies a minimum password length of 15 characters for sensitive systems.
Good evidence
Shows clear mention of this requirement and the systems it applies to.
- Check 2 of 5What an auditor asks for
Good evidence
Outcome shows the system settings clearly enforcing the rule with examples of recent changes.
- Check 3 of 5What an auditor asks for
Good evidence
Is staff consistently stating awareness of the rule and following it using secure practices.
- Check 4 of 5What an auditor asks for
Good evidence
Sign is training materials directly addressing this requirement with practical examples.
- Check 5 of 5What an auditor asks for
Good evidence
Log will show enforcement actions preventing short passwords.
Mappings
Closest match in ISO/IEC 27001: A.5.17, Management of authentication information, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.17.
ISM-0421 requires that passwords used for single-factor authentication on specified Australian Government system classifications are at least 15 characters. ISO/IEC 27001:2022 Annex A 5.17 requires a managed process for allocation and management of authentication information, which would typically include defining and enforcing password rules such as minimum length. ISM-0421 is a specific prescriptive parameter (15 characters) within the broader governance and lifecycle management expectations of Annex A 5.17.
This control partially meets A.8.5.
ISM-0421 mandates a minimum 15-character password length for single-factor authentication on non-classified, OFFICIAL: Sensitive and PROTECTED systems. ISO/IEC 27001:2022 Annex A 8.5 requires implementing secure authentication technologies and procedures aligned to access restrictions, which can include strong password controls as one authentication procedure. ISM-0421 is one concrete authentication hardening measure that would support compliance with the broader, risk- and policy-driven requirements in Annex A 8.5.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.