ASD ISM 1559 Minimum password length for secure systems
What it says
Passwords used for multi-factor authentication on non-classified, OFFICIAL: Sensitive and PROTECTED systems are a minimum of 6 characters.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishPasswords for secure systems should have at least 6 characters to enhance security.
Having a password with at least 6 characters for systems that require additional security helps keep everything safe and private. If passwords are too short, they're easier for attackers to guess, which could lead to unauthorised access, putting sensitive information and overall business operations at risk.
Free. Save your status, tasks and notes.
Why it matters
If MFA passwords are shorter than 6 characters, brute-force guessing becomes easier, increasing the risk of unauthorised access to OFFICIAL: Sensitive/PROTECTED systems and potential data compromise.
How to implement
IT team should update system settings: Ensure all systems that need extra security are set to require passwords of at least 6 characters.
This can be done by changing the password policy settings in your system's administration console.
Office manager should communicate policy: Inform all staff about the importance of using passwords with at least 6 characters on secure systems.
This could be done through an email or a brief meeting explaining why these lengths are important for security.
HR should include in onboarding: Make it part of new employee training to set strong passwords for secure systems.
During induction, provide a simple guide on creating longer passwords that are easy to remember but hard to guess.
System owner should perform regular checks: Periodically review user accounts to ensure compliance with the password length requirement.
Use system reports that show password length or request confirmation from IT.
Executive management should set the example: Encourage leaders to model good password practices by discussing their approach to creating secure passwords and regularly updating them.
This can motivate staff to take password security seriously.
Keep it running
Configure MFA to enforce a minimum 6-character password on OFFICIAL: Sensitive and PROTECTED systems; verify via regular configuration checks and authentication policy audits to ensure the setting remains enforced.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The system password policy settings document: Request documentation that shows the password policy configuration in your systems.
Look at
The part where the minimum password length is specified.
Good evidence
The document shows a minimum password length of at least 6 characters.
- Check 2 of 5What an auditor asks for
Ask for
To see user account creation logs: Request logs that evidence when user accounts require a password setup.
Look at
Entries that enforce a 6-character minimum.
Good evidence
Logs consistently show passwords of at least 6 characters at account creation.
- Check 3 of 5What an auditor asks for
Ask for
Employee training records: Request records of staff training sessions that cover password policies.
Look at
The dates and attendance to confirm all staff have been informed.
Good evidence
Complete records showing recent training with high staff participation rates.
- Check 4 of 5What an auditor asks for
Ask for
Evidence of security policy updates: Request any emails or memos that were sent to staff about updated password requirements.
Look at
Clear communication of the 6-character minimum rule.
Good evidence
Well-documented communication targeting all relevant staff.
- Check 5 of 5What an auditor asks for
Ask for
System compliance reports: Request a report that checks password policy compliance across all secure systems.
Look at
Details on accounts that don't meet the requirement.
Good evidence
Reports show over 95% compliance, with a plan to rectify any failures.
Mappings
Closest match in ISO/IEC 27001: A.5.17, Management of authentication information, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.17.
ISM-1559 sets an explicit technical rule: passwords used for MFA on specified Australian Government security domains must be at least 6 characters long. Annex A 5.17 focuses on the controlled allocation and management of authentication information (e.g. issuing, distribution, storage, reset, revocation) and advising personnel on appropriate handling. ISM-1559 can be implemented as one specific rule within the broader governance and lifecycle management process required by Annex A 5.17, but Annex A 5.17 does not itself require any particular minimum length.
This control partially meets A.8.5.
ISM-1559 mandates a specific minimum password length (at least 6 characters) when passwords are used as part of multi-factor authentication for non-classified, OFFICIAL: Sensitive and PROTECTED systems. Annex A 8.5 requires organisations to implement secure authentication technologies and procedures in line with access restrictions and access control policy, which can include setting appropriate password/PIN parameters where knowledge factors are used. ISM-1559 is a narrowly defined, measurable parameter for one aspect of authentication strength, whereas Annex A 8.5 is broader and covers authentication mechanisms and procedures more generally without prescribing a length threshold.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.