ASD ISM 1316 Ensure default wireless SSIDs are changed
What it says
Default SSIDs of wireless access points are changed.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishChange default wireless network names to enhance security.
Changing the default name of your wireless network (also called the SSID) is crucial for security. If you keep the default name, it can signal to potential attackers that you might not have changed other default settings, making your network an easier target to exploit.
Free. Save your status, tasks and notes.
Why it matters
Default SSIDs can reveal the access point vendor and suggest default configuration, aiding targeted attacks and unauthorised access attempts.
How to implement
IT staff should identify all wireless access points: Use network scanning tools to find all devices broadcasting a wireless signal in your organisation.
This ensures no access points are overlooked.
The network manager should change the default SSID: Log into each wireless router using the admin interface and navigate to the wireless settings page to rename its SSID to something unique and non-identifiable.
The IT team should establish a naming policy: Develop a consistent naming scheme for SSIDs that avoids using company names or addresses.
This policy helps maintain an organised and secure network environment.
Managers should inform staff about the SSID change: Communicate any new network names and related changes to employees so they can connect correctly.
This could be done via email or during team meetings.
The IT department should document all changes: Record each new SSID change along with the date and reason for changing in a secure and accessible document.
This provides a historical record of network changes for future reference.
Keep it running
Change all wireless access point SSIDs from vendor defaults, and document approved naming conventions to avoid revealing organisation or location details.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The network inventory report: Request a document listing all active wireless access points and their corresponding SSIDs.
Look at
Any SSID that still matches common default names like 'Linksys' or 'Netgear'.
Good evidence
Shows a list with unique, non-default SSIDs.
- Check 2 of 5What an auditor asks for
Ask for
To see the SSID naming policy: Request the document outlining the organisation's naming conventions for wireless networks.
Look at
The guidelines to ensure they specify avoiding personal or company identifiers.
Good evidence
Is a clear, specific policy document with unique guidelines.
- Check 3 of 5What an auditor asks for
Ask for
Meeting notes or emails regarding staff notifications: Check documents or emails showing that staff were informed about SSID changes.
Look at
Communication date and clarity in the message.
Good evidence
Is a record or message explaining the change.
- Check 4 of 5What an auditor asks for
Ask for
Network change logs: Request logs or reports showing changes made to SSIDs.
Look at
Entries with dates, user who made the change, and the before-and-after SSID names.
Good evidence
Includes detailed records confirming actions.
- Check 5 of 5What an auditor asks for
Ask for
Access to wireless access point settings: Request a demonstration of the current SSID settings via the access point's administration interface.
Look at
Evidence of customised, non-default SSIDs.
Good evidence
Is a live demonstration showing the configured settings.
Mappings
Closest match in ISO/IEC 27001: A.8.9, Configuration management for secure IT systems, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.9.
ISM-1316 requires that default SSIDs are changed on wireless access points as part of secure configuration. Annex A 8.9 requires configurations of hardware, software, services and networks to be established, documented, implemented, monitored and reviewed. ISM-1316 is a specific configuration baseline requirement for wireless networks that sits within Annex A 8.9's broader configuration management lifecycle.
This control partially meets A.8.20.
Annex A 8.20 requires organisations to secure and control networks and network devices, including configuration management of access technologies such as Wi-Fi. ISM-1316 supports this by requiring default wireless SSIDs to be changed, reducing predictable identifiers that can assist targeting and poor default configurations. Annex A 8.20 is broader because SSID changes are only one small element of wireless network hardening and overall network security management.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.