ASD ISM 1557 Ensure strong passwords for SECRET systems
What it says
Passwords used for single-factor authentication on SECRET systems are a minimum of 17 characters.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishPasswords for SECRET systems must be at least 17 characters long to enhance security.
This control means that any time you're logging into a system classified as SECRET, your password needs to be at least 17 characters long. This is important because longer passwords help protect sensitive information from being accessed by unauthorised people, reducing the risk of data breaches or leaks that could have serious consequences for your organisation.
Free. Save your status, tasks and notes.
Why it matters
Inadequate password length on SECRET systems increases susceptibility to brute-force guessing, enabling unauthorised access to SECRET data and broader compromise of classified operations.
How to implement
Information Technology (IT) team should update password policies for SECRET systems to require at least 17 characters.
They can do this by accessing the system's settings and adjusting the password length requirements, then communicating these changes to all users.
System owners need to educate employees about creating strong, memorable, 17-character passwords.
This can be done by conducting a short training session or sending out guidance that suggests using a mix of phrases and numbers for easy recollection.
The IT team should implement systems that will automatically check and enforce password length when users create or change their passwords.
This involves configuring the system's authentication settings to prevent passwords that don't meet the criteria.
Managers should regularly remind their teams to change passwords to ensure they remain secure.
Setting calendar reminders or including this message in team meetings can be effective ways to reinforce good password habits.
Human Resources (HR) should include password requirements and tips in the onboarding package for new employees.
This can be done by updating the employee handbook or induction materials to include guidelines on creating strong passwords.
Keep it running
Enforce a minimum 17-character password policy for all single-factor SECRET system accounts; use password managers to generate unique passwords and verify compliance via periodic audits.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The written password policy document: Request to see the section that mandates 17-character passwords for SECRET systems.
Look at
Whether the document is up-to-date and includes clear rules.
Good evidence
A current policy document detailing the password length requirements, dated within the last year.
- Check 2 of 5What an auditor asks for
Ask for
System settings configuration: Request a demonstration of how systems enforce the 17-character password rule.
Look at
The system's password settings interface.
Good evidence
The system shows an active restriction that prevents setting passwords less than 17 characters.
- Check 3 of 5What an auditor asks for
Ask for
Training records.
Look at
Records of employee training sessions that cover password creation and security. Look at attendance lists or training materials used.
Good evidence
Training records indicate regular sessions or updates, including content on password requirements.
- Check 4 of 5What an auditor asks for
Ask for
IT system change logs: Request logs that show recent changes to password policies on SECRET systems.
Look at
The change dates and descriptions provided.
Good evidence
Logs confirm policy change with a timestamp and details on the 17-character requirement.
- Check 5 of 5What an auditor asks for
Ask for
Onboarding documents: Request recent onboarding packets provided to new employees.
Look at
The section on password requirements.
Good evidence
Onboarding materials include a section on password length requirements and creation tips.
Mappings
Closest match in ISO/IEC 27001: A.5.17, Management of authentication information, which partially overlaps with this control.
ISO/IEC 27001: 1 mapping
This control partially overlaps A.5.17.
Annex A 5.17 requires organisations to manage authentication information via controlled processes and provide guidance on secure handling. ISM-1557 relates by prescribing minimum password length (17 characters) for single-factor authentication on SECRET systems, which is a specific password policy requirement managed under an Annex A 5.17 process. ISM-1557 is limited to a strength parameter for a given classification, while Annex A 5.17 covers broader lifecycle management such as provisioning, secure storage, reset and communication.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.