ASD ISM 1558 Ensure secure construction of passwords
What it says
Passwords using a sequence of words for single-factor authentication are not constructed using: - a list of categorised words - a real sentence in a natural language - song lyrics, movie or television show quotes, literature, or any other publicly available material - less than 4 random words for non-classified, OFFICIAL: Sensitive and PROTECTED systems; 5 random words for SECRET systems; or 6 random words for TOP SECRET systems.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishPasswords must not use predictable sequences, like quotes or sentences, and must meet minimum word count rules for security levels.
This control is about creating strong passwords by avoiding predictable patterns. Think of how easy it would be for someone to guess a password if you used movie quotes or a famous song lyric. If your password is too predictable, someone could gain access and cause harm, such as stealing sensitive information or causing operational disruptions.
Free. Save your status, tasks and notes.
Why it matters
Weak passphrases (e.g., quotes, predictable word lists or too few words) are easier to guess, enabling unauthorised access and data compromise.
How to implement
IT managers should develop a password policy that specifies the use of random words rather than predictable sequences.
Use examples to illustrate combinations of random words and explain why they are more secure.
Office managers should train staff on how to choose passwords that follow these guidelines.
Conduct workshops or information sessions demonstrating the creation of passwords using four or more random words.
HR should include password creation techniques in new employee onboarding materials.
Provide a checklist or guide that outlines the rules for crafting secure passwords.
System owners should review current password practices and update password requirements to meet the new standards.
Ensure all systems enforce these rules through technical settings.
IT staff should implement tools that check password submissions against a list of disallowed patterns, such as famous quotes or song lyrics.
Automate rejection of passwords that do not meet the complexity criteria.
Keep it running
Use 4-6 truly random words per classification; avoid quotes, lyrics, real sentences, categorised word lists, and predictable word order.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The organisation's password policy document.
Look at
Sections detailing the prohibition of common phrases and patterns.
Good evidence
Includes clear guidelines on constructing passwords using random words and avoiding predictable sequences.
- Check 2 of 5What an auditor asks for
Ask for
Evidence of staff training sessions on password security.
Look at
Attendance records and training materials.
Good evidence
Shows regular training sessions and materials that emphasise avoiding predictable patterns in passwords.
- Check 3 of 5What an auditor asks for
Look at
Instances of rejected passwords based on automated checks.
Good evidence
Would be seeing systems in place that flag and prevent the use of simplistic passwords.
- Check 4 of 5What an auditor asks for
Ask for
A list of password management tools in use.
Look at
Their capability to enforce password policies.
Good evidence
Includes tools that automatically enforce the minimum word count and randomness requirements.
- Check 5 of 5What an auditor asks for
Look at
Guides or instructions given to new employees.
Good evidence
Shows clear instructions that align with this control to prevent the use of predictable sequences in passwords.
Mappings
Closest match in ISO/IEC 27001: A.5.17, Management of authentication information, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.17.
ISM-1558 requires passwords (as authentication information) to be securely constructed, explicitly prohibiting predictable word sequences (e.g. quotes/sentences) and mandating minimum random-word counts by classification level. This relates to Annex A 5.17 because it is a concrete, prescriptive subset of managing authentication information-specifically the quality and composition requirements for one type of authenticator (password/passphrase). Annex A 5.17 is broader, covering the overall allocation, management and user handling guidance for authentication information beyond just passphrase construction rules.
This control partially meets A.8.5.
ISM-1558 requires secure construction of passwords for single-factor authentication, including bans on predictable phrases and minimum random-word lengths by system classification. This relates to Annex A 8.5 because secure password/passphrase construction is one specific authentication procedure that supports secure authentication technologies and processes. Annex A 8.5 is broader, encompassing multiple authentication methods (e.g. MFA, tokens, certificates) and procedural controls beyond password composition alone.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.