ASD ISM 1330 Limit PMK caching duration on wireless networks
What it says
The PMK caching period is not set to greater than 1440 minutes (24 hours).
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure that stored authentication data for networks isn't kept for more than a day.
This control is about making sure that when a device connects to your Wi-Fi network, the information that proves it is allowed to connect isn't stored for more than 24 hours. This matters because if an unauthorised person gets hold of this information, they could easily access your wireless network and misuse your data or resources.
Free. Save your status, tasks and notes.
Why it matters
If PMK caching exceeds 24 hours, compromised credentials can keep working longer, enabling unauthorised WLAN access and raising breach risk.
How to implement
The IT team should configure the wireless network settings to limit the caching duration of previous authentication.
This can be done by accessing the wireless controller or access point settings and setting the PMK cache duration to a maximum of 1440 minutes.
Business owners should ask their IT provider to regularly review these settings to ensure compliance with security guidelines.
During these checks, adjustments can be made to maintain the 24-hour limit if software updates have altered settings.
Office managers should ensure that policy documentation reflects this requirement and that team members understand why it's important to restrict the duration of stored network access data.
IT support staff should train anyone managing wireless networks on how to implement and verify the PMK caching settings so there is no accidental deviation from the policy.
Authorised personnel responsible for network security should receive alerts for any changes to the PMK caching duration settings to ensure prompt action can be taken to rectify any deviations.
Keep it running
Check WLC/AP PMK caching is set to 1440 minutes (24 hours) or less, and review after firmware changes or template updates.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The network configuration report: Request the report that shows the current PMK caching settings.
Look at
The duration setting for PMK caching.
Good evidence
Setup shows PMK caching set to no more than 1440 minutes.
- Check 2 of 5What an auditor asks for
Ask for
The company's wireless security policy document. Check if the policy clearly states PMK caching should not exceed 24 hours.
Good evidence
Document is one that is clear and easy to follow, with specific times outlined.
- Check 3 of 5What an auditor asks for
Ask for
Evidence of the most recent network review.
Look at
The dates and outcomes of the checks done on PMK settings.
Good evidence
Includes regular reviews with actions taken to correct any discrepancies.
- Check 4 of 5What an auditor asks for
Ask for
Security logs that show when changes to network settings were made.
Look at
Entries that indicate PMK cache duration and any changes to this value.
Good evidence
Should show consistent settings with responsible change management documentation.
- Check 5 of 5What an auditor asks for
Ask for
Staff training records: Request evidence of training or instructions provided to personnel on handling authentication data securely.
Look at
Whether these training sessions address PMK caching. Good records show attendance and up-to-date training on current security practices.
Mappings
Closest match in ISO/IEC 27001: A.8.5, Secure authentication technologies and procedures, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.5.
ISM-1330 mandates a concrete control on wireless authentication by limiting PMK caching to 24 hours to constrain reuse of derived keying material. This partially aligns with Annex A 8.5 because PMK caching is an aspect of secure authentication technologies and procedures on wireless networks. Annex A 8.5 is higher-level and covers many authentication mechanisms beyond Wi‑Fi key caching, whereas ISM-1330 is a specific parameter setting for one authentication context.
This control partially meets A.8.20.
ISM-1330 requires organisations to limit the Pairwise Master Key (PMK) caching duration on wireless networks to no more than 1440 minutes to reduce exposure from long-lived cached authentication material. This relates to Annex A 8.20 because configuring secure parameters on wireless infrastructure (including key/session caching behaviours) is part of securing and managing network devices. Annex A 8.20 is broader and does not prescribe the specific PMK caching limit, while ISM-1330 is a specific hardening requirement for wireless authentication behaviour.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.