ASD ISM 1558Ensure Secure Construction of Passwords
Official control statement
Passwords using a sequence of words for single-factor authentication are not constructed using: - a list of categorised words - a real sentence in a natural language - song lyrics, movie or television show quotes, literature, or any other publicly available material - less than 4 random words for non-classified, OFFICIAL: Sensitive and PROTECTED systems; 5 random words for SECRET systems; or 6 random words for TOP SECRET systems.
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
Passwords must not use predictable sequences, like quotes or sentences, and must meet minimum word count rules for security levels.
What this means in practice
This control is about creating strong passwords by avoiding predictable patterns. Think of how easy it would be for someone to guess a password if you used movie quotes or a famous song lyric. If your password is too predictable, someone could gain access and cause harm, such as stealing sensitive information or causing operational disruptions.
Framework
ASD Information Security Manual (ISM)
Control effect (Control Stack)
Preventative
Classifications
NC, OS, P, S, TS
ISM last updated
Dec 2025
Control Stack last updated
29 Sept 2026
E8 maturity levels
N/A
Why it matters
Weak passphrases (e.g., quotes, predictable word lists or too few words) are easier to guess, enabling unauthorised access and data compromise.
Operational notes
Use 4-6 truly random words per classification; avoid quotes, lyrics, real sentences, categorised word lists, and predictable word order.
Implementation tips
- IT managers should develop a password policy that specifies the use of random words rather than predictable sequences. Use examples to illustrate combinations of random words and explain why they are more secure.
- Office managers should train staff on how to choose passwords that follow these guidelines. Conduct workshops or information sessions demonstrating the creation of passwords using four or more random words.
- HR should include password creation techniques in new employee onboarding materials. Provide a checklist or guide that outlines the rules for crafting secure passwords.
- System owners should review current password practices and update password requirements to meet the new standards. Ensure all systems enforce these rules through technical settings.
- IT staff should implement tools that check password submissions against a list of disallowed patterns, such as famous quotes or song lyrics. Automate rejection of passwords that do not meet the complexity criteria.
Audit / evidence tips
- AskThe organisation's password policy documentLook atSections detailing the prohibition of common phrases and patternsGoodIncludes clear guidelines on constructing passwords using random words and avoiding predictable sequences
- AskEvidence of staff training sessions on password securityLook atAttendance records and training materialsGoodShows regular training sessions and materials that emphasise avoiding predictable patterns in passwords
- Look atInstances of rejected passwords based on automated checksGoodWould be seeing systems in place that flag and prevent the use of simplistic passwords
- AskA list of password management tools in useLook atTheir capability to enforce password policiesGoodIncludes tools that automatically enforce the minimum word count and randomness requirements
- Look atGuides or instructions given to new employeesGoodShows clear instructions that align with this control to prevent the use of predictable sequences in passwords
Cross-framework mappings
How ISM-1558 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
layersPartially meets(2)expand_less | ||
| Annex A 5.17 | ISM-1558 requires passwords (as authentication information) to be securely constructed, explicitly prohibiting predictable word sequences... | |
| Annex A 8.5 | ISM-1558 requires secure construction of passwords for single-factor authentication, including bans on predictable phrases and minimum ra... | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in System access
See all Guidelines for system access controls, or browse the full ASD ISM library.