ASD ISM 1227 Randomly generate user account credentials
What it says
Credentials set for user accounts are randomly generated.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUser account passwords must be created randomly to enhance security.
Randomly generating passwords for user accounts makes it much harder for attackers to guess or crack them. If your passwords are predictable, cybercriminals can easily access your systems, potentially leading to data theft, financial loss, and damage to your reputation.
Free. Save your status, tasks and notes.
Why it matters
Without randomly generated user credentials, attackers can guess or crack predictable patterns, enabling account compromise and unauthorised access to sensitive data.
How to implement
System administrator should use a password manager tool to generate passwords: Choose a reliable password manager that can create passwords using different characters and lengths.
Ensure it is configured to use at least 12 characters, including letters, numbers, and symbols.
IT team should implement a policy for password generation: Develop a clear policy for how passwords are to be created and maintained.
Communicate this policy to all staff and make sure it is easily accessible.
Office manager should ensure employees use the password manager: Brief staff on the importance of secure passwords and how to use the password manager.
Provide a short training session and written instructions on accessing and using the tool.
IT security officer should regularly audit password creation: Set up a schedule to review how passwords are being generated and stored.
Check that all processes align with organisational policies and provide feedback if deviations are identified.
Executive management should support strong password practices: Encourage a culture of security by reinforcing the importance of password policies in meetings and communications.
Share success stories and challenges to keep security front-of-mind.
Keep it running
Use an approved credential generator to create high-entropy initial passwords for all new accounts, block manual setting, and log/alert on any non-random credentials.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The password policy documentation: Request a copy of the current policy on password generation and management.
Look at
How it defines password complexity and management processes.
Good evidence
Is a clear, detailed policy outlining the use of random generation tools and complexity requirements.
- Check 2 of 5What an auditor asks for
Ask for
To see a demonstration of the password manager tool: Request IT to show how new passwords are created using the tool.
Look at
How the tool generates the randomness of passwords.
Good evidence
Outcome is witnessing a tool that consistently creates strong, unpredictable passwords.
- Check 3 of 5What an auditor asks for
Ask for
Evidence of user training sessions related to password tools: Review records of any sessions conducted to train employees on password security.
Look at
Attendance records and materials used during training.
Good evidence
Result is a documented proof of regular, comprehensive training sessions.
- Check 4 of 5What an auditor asks for
Ask for
To review the schedule for password audits: Request the timeline showing regular audits of the password practices.
Look at
Past audit dates and findings.
Good evidence
Should show consistent audits that report adherence or issues with resolution steps.
- Check 5 of 5What an auditor asks for
Ask for
Feedback or survey results from staff about password practices: Review feedback to understand how the use of the new password manager is perceived by staff.
Look at
Comments that indicate ease of use and understanding. Good feedback shows staff finds the process improves security without significant inconvenience.
Mappings
Closest match in ASD Essential Eight: E8-RA-ML2.5, Long, unique, and managed credentials for admin accounts, which partially overlaps with this control.
ASD Essential Eight: 1 mapping
This control partially overlaps E8-RA-ML2.5.
ISM-1227 requires credentials set for user accounts to be randomly generated to improve password unpredictability. This supports E8-RA-ML2.5 because random generation is a practical means of achieving "unique" and "unpredictable" credentials for high-value accounts (e.g. break glass, local administrator and service accounts). E8-RA-ML2.5 is broader as it also requires sufficient length and active management of those credentials, not just randomness at creation.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-13.6Enforce unique credentials per system and account, especially in high-privilege contextsPartially overlaps
This control partially overlaps IT.PRO-13.6.
IT.PRO-13.6 requires user, machine, system and service account credentials to be unique per system or account, especially where privileged; ISM-1227 requires credentials set for user accounts to be randomly generated, which supports that uniqueness for user accounts.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.