Skip to content
Communications systems
ASD ISMISM-0590

ASD ISM 0590 Ensure strong authentication for multi-function devices

What it says

Authentication measures for MFDs are the same strength as those used for workstations on networks they are connected to.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Multi-function devices should have security measures as strong as those for computers they connect to.

Multi-function devices, like printers that also scan or fax, need the same strong security protections as the computers they connect to. If these devices are not properly secured, hackers could potentially access the network through them, leading to data leaks or other security breaches.

Why it matters

If MFD authentication is weaker than workstation controls, attackers can access scan shares and admin consoles to pivot, exfiltrate data and disrupt services.

How to implement

  1. The IT team should ensure that any multi-function device (MFD) on the network requires a strong password for user access.

    This can be done by configuring the device settings to enforce passwords that are at least eight characters long and include a mix of letters, numbers, and symbols.

  2. Office managers should work with their IT support to keep the software on MFDs up to date.

    This involves setting up automatic software updates or regularly checking the manufacturers' websites for the latest updates and manually installing them to close any security loopholes.

  3. System administrators need to restrict MFDs to only connect to secure, trusted networks.

    They can do this by configuring the network settings on each device to ensure it connects only to the company's official network, which is secured and monitored.

  4. Procurement teams should purchase MFDs that support advanced authentication methods.

    Verify with vendors that new devices can use authentication techniques such as swipe cards or fingerprint scans for high-security environments.

  5. HR should ensure that all staff are trained on strong password practices and the importance of securing MFD access.

    Conduct regular training sessions and provide easy-to-follow guides on creating and maintaining secure passwords.

Keep it running

Configure MFD logon to match workstation auth (e.g., AD/LDAP + MFA where used); disable defaults, audit access, and keep credentials/policies aligned.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    A report on current password policies for MFDs: The report should list the password requirements set on each device.

    Look at

    Details on password complexity and expiration policies.

    Good evidence

    Would show a policy that enforces complex passwords with mandatory changes every 90 days.

  2. Check 2 of 5What an auditor asks for

    Good evidence

    Includes a log showing consistent updating practices.

  3. Check 3 of 5What an auditor asks for

    Ask for

    A list of networks MFDs are authorised to connect to: Check the list for any unauthorised networks.

    Good evidence

    Would show each MFD limited to connecting only to the secured company network.

  4. Check 4 of 5What an auditor asks for

    Look at

    Features like advanced authentication methods.

    Good evidence

    Would have MFDs that support modern security measures such as biometric access.

  5. Check 5 of 5What an auditor asks for

    Good evidence

    Would show regular training sessions with all relevant staff attending at least annually.

Mappings

Closest match in ISO/IEC 27001: A.8.5, Secure authentication technologies and procedures, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.8.5Secure authentication technologies and proceduresPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.