ASD ISM 1312 Changing default SNMP community strings on devices
What it says
All default SNMP community strings on network devices are changed and write access is disabled.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishTo enhance security, change default SNMP passwords and disable write access on network devices.
This control is about making sure the 'locks' on our digital doors aren't left on the factory settings. Many network devices use a feature called SNMP for tasks like monitoring. If the default settings aren't changed, it can be easy for outsiders to sneak in and mess with our systems.
Free. Save your status, tasks and notes.
Why it matters
Leaving default SNMP community strings in place (or allowing write access) enables device takeover, outages, and unauthorised configuration changes.
How to implement
IT team should identify all network devices: First, make a list of all devices that use SNMP, like routers or switches, to ensure none are missed.
IT team should change default SNMP settings: Replace the default 'community strings' (think of these as passwords) with strong, unique ones that follow good password practices.
Use a secure method and tool to change these settings so unauthorised users can't access them.
IT team should disable SNMP write access: Configure the devices so that SNMP can only read information and not make changes.
This is like allowing someone to see inside but not touch anything, and instructions for this can typically be found in device manuals or online support guides.
System owners should liaise with the IT team: Regularly review the SNMP settings to ensure they remain secure and effective.
This helps catch any accidental changes or new threats that might have surfaced.
Managers and team leads should ensure security awareness: Educate staff on the importance of network security, including changing default settings.
Use regular reminders or training sessions to keep this top of mind.
Keep it running
Audit all devices for default SNMP community strings; set unique read-only strings, disable SNMP write, and log/alert on SNMP configuration changes.
Evidence and audit
- Check 1 of 4What an auditor asks for
Ask for
The SNMP configuration report: Request documentation showing current SNMP settings on network devices.
Look at
The settings details: Check that default community strings are replaced with custom ones and that write access is disabled.
Good evidence
Evidence of unique, complex community strings and disabled write access across all devices.
- Check 2 of 4What an auditor asks for
Ask for
Network device inventory: Request a list of all network devices known to use SNMP.
Look at
Inclusion of all relevant devices: Verify every network device is accounted for in the SNMP configuration report.
Good evidence
Comprehensive inventory matching the SNMP configuration details and reviews with no missing entries.
- Check 3 of 4What an auditor asks for
Ask for
Evidence of regular security reviews: Request records showing periodic checks of SNMP settings by the IT team.
Look at
Timing and outcomes of reviews: Ensure reviews occur regularly, with no significant issues unaddressed.
Good evidence
Consistent review reports, logs of action taken, and resolved issues.
- Check 4 of 4What an auditor asks for
Ask for
Training records or awareness sessions: Request documentation or schedules of any sessions held for staff education on network security.
Look at
Attendance and content: Check that team leads and relevant staff received proper guidance on changing default settings.
Good evidence
Regularly updated sessions with attendance logs and comprehensive content covering SNMP security.
Mappings
Closest match in ISO/IEC 27001: A.8.9, Configuration management for secure IT systems, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.9.
ISM-1312 requires a specific secure configuration outcome for SNMP on network devices (non-default community strings and no write access). Annex A 8.9 requires security configurations for hardware, software, services and networks to be established, documented, implemented, monitored and reviewed, which encompasses enforcing secure SNMP configuration baselines. ISM-1312 is one prescriptive configuration requirement within the broader configuration management framework of Annex A 8.9.
This control partially meets A.8.20.
Annex A 8.20 requires secure management and control of networks and network devices to protect information. ISM-1312 requires hardening network device management by changing default SNMP community strings and disabling write access, directly reducing unauthorised device control and configuration tampering. This is a specific device-hardening requirement, whereas Annex A 8.20 is broader and covers multiple network security domains beyond SNMP configuration.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.