ASD ISM 1260 Secure server applications by changing default credentials
What it says
Default user accounts or credentials for server applications, including for any pre-configured user accounts, are changed, disabled or removed during initial setup.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishChange or remove default user accounts and passwords in server apps to enhance security from the start.
This control is about changing the default usernames and passwords on your server applications. It matters because hackers often know these defaults and can easily gain access to your system if they aren't changed, leading to potential data breaches or outages.
Free. Save your status, tasks and notes.
Why it matters
If default accounts or passwords remain, attackers can log in easily, take over the server application and access or alter sensitive data.
How to implement
The IT team should identify all new server applications installed.
This means keeping a list of all software that runs on your servers. By doing this, they'll know where to focus their efforts when changing passwords.
IT administrators must change default credentials during the first setup.
They should replace these with strong, unique passwords by using a password manager that generates and stores them securely.
System owners should validate the removal of unnecessary default user accounts.
They can do this by checking the user account settings in each application and ensuring only essential accounts remain.
Managers should enforce a policy for regular reviews of server credentials.
They can set up reminders in their calendar to check with IT every six months, ensuring that no default accounts have been re-enabled.
Procurement officers should work closely with suppliers to ensure new applications come with guidance on securing user accounts.
They can ask for documentation that specifies how to change defaults as part of the purchase agreement.
Keep it running
During install, change/disable/remove all default and pre-configured accounts; routinely scan apps for default logins and rotate credentials after upgrades.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A list of all server applications in use: Request the most current inventory list.
Look at
Whether each application has had its default credentials changed.
Good evidence
Will confirm no defaults remain and will cite unique, stronger credentials in use.
- Check 2 of 5What an auditor asks for
Ask for
To see the password policy document: Request the IT team's written guidelines on password creation.
Look at
Instructions to change default passwords during setup.
Good evidence
Sign is if it follows recommendations from trusted sources like the Australian Cyber Security Centre (ACSC).
- Check 3 of 5What an auditor asks for
Ask for
Access records from recent server audits: Examine reports from recent walkthroughs or scans.
Look at
Notes indicating any default credentials that were changed or if there were problem areas highlighted.
Good evidence
Includes no unresolved issues concerning default credentials.
- Check 4 of 5What an auditor asks for
Look at
The password manager system and check for the use of unique, complex passwords.
Good evidence
Shows that default passwords are replaced with secure ones.
- Check 5 of 5What an auditor asks for
Ask for
Documented secure setup procedures: Request the step-by-step guides followed by IT.
Look at
Steps that describe changing or removing default accounts during initial installation.
Good evidence
Is a clear, dated checklist showing adherence to best practices.
Mappings
Closest match in ISO/IEC 27001: A.8.9, Configuration management for secure IT systems, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.9.
ISM-1260 requires default server application accounts and credentials to be changed, disabled or removed as part of initial setup. This directly aligns with Annex A 8.9 because changing default accounts/credentials is a concrete configuration baseline requirement for applications and systems. Annex A 8.9 is broader, covering establishment, documentation, monitoring and review of configurations across hardware, software, services and networks, whereas ISM-1260 is one specific secure configuration requirement.
ASD Essentials for enterprise IT: 1 mapping
This control partially overlaps IT.PRO-13.1.
IT.PRO-13.1 requires default and unused accounts to be regularly identified and disabled or removed; ISM-1260 requires default server application accounts or credentials to be changed, disabled or removed during initial setup, addressing the default account part.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.