Skip to content
System access
ASD ISMISM-0422

ASD ISM 0422 Ensuring strong passwords for TOP SECRET systems

What it says

Passwords used for single-factor authentication on TOP SECRET systems are a minimum of 20 characters.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Passwords on TOP SECRET systems should be at least 20 characters to ensure strong security.

This control means that passwords for systems holding highly sensitive information need to be at least 20 characters long. It's important because a weak password could let someone unauthorised into your system, potentially leading to stolen information, financial losses, or harm to your reputation if sensitive data leaks.

Why it matters

Weak single-factor passwords on TOP SECRET systems increase the likelihood of credential guessing and unauthorised access, risking compromise of highly classified information and national security.

How to implement

  1. IT team should create a password policy: Draft a company-wide policy that mandates all passwords on top-secret systems are at least 20 characters.

    Include guidance on creating these passwords, such as using a mix of letters, numbers, and symbols.

  2. System owner should implement password checks: Ensure the systems require passwords to be a minimum of 20 characters by adjusting settings in your system's configuration.

    This could involve working with IT to enable this security measure.

  3. Managers should train employees: Organise training sessions to teach staff how to create strong, memorable passwords.

    This training should include examples and tools, like password managers, to help employees comply with the policy.

  4. Board or executive team should ensure oversight: Regularly review password policies and conduct risk assessments to ensure compliance.

    This involves checking if systems and staff adhere to the prescribed 20-character rule.

  5. HR or compliance officer should monitor adherence: Implement a procedure to check password compliance regularly.

    This might include random audits or automated monitoring to ensure all parts of the organisation abide by the 20-character requirement.

Keep it running

Enforce a minimum 20-character password policy for TOP SECRET single-factor accounts; regularly audit compliance, prevent reuse, and alert on repeated failed logons indicating password guessing.

Evidence and audit

  1. Check 1 of 3What an auditor asks for

    Ask for

    The password policy document: Request the official document that outlines the password requirements for top-secret systems.

    Look at

    The specified minimum character limit and creation guidelines. Good evidence is a policy clearly stating the 20-character minimum requirement.

  2. Check 2 of 3What an auditor asks for

    Ask for

    A demonstration of how systems enforce the 20-character password minimum. Check the settings against the policy requirements. Good evidence should show a configuration that cannot accept passwords shorter than 20 characters.

    Look at

    System configuration settings.

    Good evidence

    Is a description of monitoring tools or checks in place to enforce the policy.

  3. Check 3 of 3What an auditor asks for

    Ask for

    Monitoring and audit logs: Request evidence of ongoing compliance checks.

    Look at

    Documentation or system logs that show password length is regularly reviewed. Good evidence is consistent records demonstrating checks and any corrective actions taken.

Mappings

Closest match in ISO/IEC 27001: A.5.17, Management of authentication information, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.5.17Management of authentication informationPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.