ASD ISM 1546 Ensure user authentication before system access
What it says
Users are authenticated before they are granted access to a system and its resources.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishVerify user identities before they can access any system.
This control is about making sure that every person trying to access a system is who they say they are. It's like checking IDs at the door of a club. If someone unverified gets in, they might cause harm, like accessing sensitive information or disrupting operations.
Free. Save your status, tasks and notes.
Why it matters
Without strong user authentication, attackers can impersonate users to access systems and resources, leading to data compromise and unauthorised actions.
How to implement
The IT team should implement user authentication measures.
They can use passwords or passphrases, ensuring they are strong and follow your organisation's guidelines.
System administrators should set up multi-factor authentication (MFA).
This means users will need to provide two or more pieces of evidence to verify their identity, like a password and a code sent to their phone.
HR should ensure onboarding includes user authentication training.
Employees need to understand why it's important to protect their login information and how to use authentication systems properly.
The IT team should regularly update authentication software.
This includes applying patches and updates to make sure the system is secure against known vulnerabilities.
Managers should periodically review access logs.
They can look for any unusual login attempts or patterns that might suggest an unauthorised access attempt.
Keep it running
Enforce MFA for interactive and remote access, review authentication logs for repeated failures, and promptly disable or lock accounts showing suspicious activity.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The organisation's authentication policy document: Request the document that outlines how users are authenticated before accessing systems.
Look at
The details of procedures for password management and MFA.
Good evidence
Shows clear guidelines that meet the organisation's security needs.
- Check 2 of 5What an auditor asks for
Ask for
A list of users with access to critical systems: Ensure there is a register of who is granted access and what level they have.
Look at
Regular updates and some kind of approval process.
Good evidence
Is an up-to-date list that matches current staff roles.
- Check 3 of 5What an auditor asks for
Ask for
Recent training records on authentication procedures: Request evidence of employee training on access control.
Look at
Participation records and training materials used.
Good evidence
Includes attendees' names, dates, and clear instruction content.
- Check 4 of 5What an auditor asks for
Look at
Records showing who accessed the system, when, and from where.
Good evidence
Includes timestamps, user IDs, and IP addresses for relevant access attempts, with no unexplained anomalies.
- Check 5 of 5What an auditor asks for
Ask for
Recent incident reports related to unauthorised access attempts.
Look at
The actions taken in response to any such incidents.
Good evidence
Includes documented reports with dates, the nature of each incident, and the resolutions or lessons learned.
Mappings
Closest match in ASD Essential Eight: E8-MF-ML1.1, Require multi-factor authentication for sensitive online services, which this control covers in full and more.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.5.
ISM-1546 requires users to be authenticated before they are granted access to a system and its resources. ISO/IEC 27001:2022 Annex A 8.5 requires implementing secure authentication technologies and procedures aligned to access restrictions and access control policy, which includes authenticating users before access. Annex A 8.5 is broader because it also covers the selection and security of authentication methods and procedures.
ASD Essential Eight: 3 mappings
This control is broader than E8-MF-ML1.1.
ISM-1546 requires users to be authenticated before they are granted access. ASD Essential Eight E8-MF-ML1.1 enhances this by specifying multi-factor authentication for users accessing sensitive data online services, which is one way to meet authentication-before-access for a subset of services. E8-MF-ML1.1 focuses on sensitive online services and mandates MFA.
This control is broader than E8-MF-ML1.7.
E8-MF-ML1.7 requires a specific form of user authentication: MFA with two factors. ISM-1546 is broader, requiring users to be authenticated before being granted access to systems and resources, without mandating MFA or factor types. E8-MF-ML1.7 is a stronger, more specific method that sits within the general authentication requirement of ISM-1546.
This control is broader than E8-MF-ML3.2.
E8-MF-ML3.2 requires phishing-resistant MFA for customers of online customer services. ISM-1546 is broader, requiring users to be authenticated before access to a system and its resources, without specifying MFA or phishing-resistance. E8-MF-ML3.2 is a specific mechanism and assurance level within the broader authentication requirement of ISM-1546.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.