ASD ISM 1304 Secure network devices by changing default credentials
What it says
Default user accounts or credentials for network devices, including for any pre-configured user accounts, are changed, disabled or removed during initial setup.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishDuring setup, change or remove default login details for network devices to enhance security.
Changing the default username and password on network devices, like routers or modems, is crucial to prevent unauthorised access to your network. If someone with bad intentions finds out these default settings, they could easily get into your system, interfere with operations, or steal sensitive information.
Free. Save your status, tasks and notes.
Why it matters
If default device accounts are left unchanged, attackers can log in using known defaults and take control of routers/switches, enabling network compromise and data loss.
How to implement
The IT team should create a checklist for setting up new network devices that includes changing default usernames and passwords.
They can do this by consulting the device manuals for default login details and ensuring these are changed to unique, strong credentials immediately during setup.
Managers should ensure that the IT team regularly reviews and documents the credentials of all network devices.
This can be done by logging the last updated passwords and checking them every few months to make sure they're still secure.
Procurement officers should only buy network equipment that includes instructions for changing default credentials.
Before purchasing, they can ask suppliers to confirm that easy-to-follow steps are provided for securing the devices.
The system owner should arrange for periodic training sessions for staff who handle network equipment.
These sessions should cover the importance of changing default settings and provide step-by-step guidance on how to manage device security correctly.
Office managers should coordinate with IT to ensure that any devices brought into the office have their default settings changed before being used.
They can maintain a log of network devices with dates of when default credentials were updated.
Keep it running
During initial setup, change or disable all default and pre-configured accounts on network devices; periodically verify configs and review logs for repeated failed/default-credential attempts.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The network device configuration policy document: Request evidence of an official policy that mandates changing default credentials during setup.
Look at
The sections detailing the procedures for altering device login information.
Good evidence
Includes clear instructions along with recorded dates and responsible staff.
- Check 2 of 5What an auditor asks for
Ask for
Logs or reports showing initial setup records of network devices: Check if the logs indicate when and by whom default credentials were changed.
Good evidence
Includes detailed logs showing changes from default to secure credentials for each device.
- Check 3 of 5What an auditor asks for
Ask for
A list of network devices in use: Request a list showing all active network devices in the organisation.
Look at
The list for any devices that use default credentials. Good results show all devices have secure, unique login details.
- Check 4 of 5What an auditor asks for
Ask for
Training records on security practices for IT staff: Request to see records of training sessions relating to device security.
Look at
Dates, attendance, and content covered in the training. Good records will show complete attendance and a clear focus on changing default credentials.
- Check 5 of 5What an auditor asks for
Ask for
Evidence of procurement requirements for network devices: Confirm with procurement policies or checklists that stipulate the need for changing default credentials. Good evidence would be policies or checklists that specifically require suppliers to provide security guidance.
Mappings
Closest match in ISO/IEC 27001: A.8.9, Configuration management for secure IT systems, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.9.
ISM-1304 demands that default accounts or credentials on network devices be changed, disabled, or removed at initial setup. Annex A 8.9 calls for security configurations across hardware, software, services, and networks to be established, documented, implemented, monitored, and reviewed, often including baseline hardening like removing default device credentials. Annex A 8.9 offers a wider scope in configuration governance and monitoring, whereas ISM-1304 focuses specifically on a single device hardening step.
This control partially meets A.8.20.
ISM-1304 requires default user accounts or credentials on network devices (including pre-configured accounts) to be changed, disabled or removed during initial setup. Annex A 8.20 requires networks and network devices to be secured, managed, and controlled, including hardening activities such as removing default credentials. Annex A 8.20 addresses a broader scope of network device security lifecycle controls, while ISM-1304 is a focussed hardening requirement for default credentials.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.