ASD ISM 1317 Secure naming of non-public wireless networks
What it says
SSIDs of non-public wireless networks are not readily associated with an organisation, the location of their premises or the functionality of wireless networks.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure non-public WiFi network names (SSIDs) don't reveal info about the organisation or location.
When setting up Wi-Fi for staff and authorised people only, it's important to use a name that doesn't give away any details about your business or where you're located. This matters because if the wrong people know your network's purpose or location, they might try to break into it, risking your data and privacy.
Free. Save your status, tasks and notes.
Why it matters
If non-public SSIDs expose the organisation, site or network purpose, attackers can identify targets and plan focused intrusion or phishing attempts.
How to implement
The IT team should choose a generic name for the Wi-Fi network that doesn't include the company's name or location.
They can use a name that is simple and not linked to your business, like 'BlueWave43'.
The office manager should communicate to staff and authorised users to avoid discussing or sharing the Wi-Fi name in public places.
This can be done by sending a company-wide email with instructions on keeping network details private.
System administrators should periodically review and change the Wi-Fi SSID as needed.
They can schedule biannual reviews to consider if the current naming convention still sufficiently disguises the network origin.
Human Resources should include clear information in the employee handbook about why it's important to keep the SSID secret.
They can make this part of the new hire orientation session to ensure everyone understands the policy from day one.
Procurement should ensure that when new networking equipment is purchased, the default Wi-Fi name (SSID) is changed immediately.
They should check with the IT team that the new names follow the non-descriptive naming policy.
Keep it running
Use neutral, non-identifying SSIDs for non-public WLANs; avoid business names, building/floor labels and function names, and review SSIDs after changes.
Evidence and audit
- Check 1 of 3What an auditor asks for
Ask for
A list of current Wi-Fi network names.
Look at
The names to see if they include any identifiable information like business name or location.
Good evidence
Result is seeing generic, non-identifiable names.
- Check 2 of 3What an auditor asks for
Good evidence
Would be a policy document with a section distinctly addressing SSID naming.
- Check 3 of 3What an auditor asks for
Ask for
A few staff members what they know about the Wi-Fi naming policy. A satisfactory answer is that employees understand the purpose and importance of keeping names non-identifiable.
Look at
Records of who made changes and why.
Good evidence
Example includes detailed logs demonstrating deliberate non-identifiable naming choices.
Mappings
Closest match in ISO/IEC 27001: A.8.20, Network and network devices security, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.20.
ISM-1317 requires that SSIDs for non-public wireless networks are named so they are not readily associated with the organisation, its locations, or the network's function. This relates to Annex A 8.20 as secure management of networks and network devices includes reducing information leakage via wireless network identifiers that can aid reconnaissance. Annex A 8.20 is broader, covering the full range of network security controls, while ISM-1317 is a specific hardening requirement for wireless SSID naming.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.