ASD ISM 1560 Ensure strong passwords for SECRET system authentication
What it says
Passwords used for multi-factor authentication on SECRET systems are a minimum of 8 characters.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishPasswords for SECRET systems using multi-factor authentication must be at least 8 characters.
This control ensures that when logging into important systems, passwords used must be at least eight characters long, even if you're using a second method to verify your identity, like a text message code. This matters because strong passwords are a first line of defence against unauthorised access. If passwords are weak, cyber criminals can easily break into systems and steal sensitive information, causing operational downtime and damage to your reputation.
Free. Save your status, tasks and notes.
Why it matters
If MFA passwords on SECRET systems are under 8 characters, they are easier to guess or crack, increasing account compromise and SECRET information exposure risk.
How to implement
System owners should ensure all users create strong passwords for systems that manage sensitive data.
Encourage users by providing examples of phrases turned into passwords with at least eight characters.
The IT team should configure systems to automatically reject passwords that do not meet the eight-character minimum requirement.
This can be done by setting password policies in the system's security settings.
Managers should conduct regular training sessions, educating staff on the importance of password strength and how to create memorable yet secure passwords.
Use role-playing exercises to demonstrate the risks of weak passwords.
HR should make it a policy to remind new employees during onboarding about the organisation's password requirements.
Include a checklist or tip sheet in the welcome pack.
IT leads should regularly review recent password policies to ensure they are applied consistently across all systems.
Use system logs to verify compliance and correct any deviations promptly.
Keep it running
Configure authentication to reject MFA passwords under 8 characters on SECRET systems, and routinely test/monitor for accounts that bypass the minimum length.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
System configuration settings: Request access to the system's password policy settings in the administration console.
Look at
The character length rules to ensure they state a minimum of eight characters.
Good evidence
Is a screenshot showing the enforced eight-character minimum.
- Check 2 of 5What an auditor asks for
Look at
Clear steps on creating a compliant password.
Good evidence
Includes sections dedicated to password length guidelines.
- Check 3 of 5What an auditor asks for
Ask for
Training session materials: Request slides or videos from recent training sessions about password policies.
Look at
The emphasis on password length and examples provided.
Good evidence
Highlights the eight-character requirement.
- Check 4 of 5What an auditor asks for
Look at
The content to check for consistent messaging about maintaining strong passwords that meet the required length.
Good evidence
Includes regular reminders with security tips.
- Check 5 of 5What an auditor asks for
Ask for
The onboarding pack materials: Verify that these materials cover the password policy, including the length requirement.
Good evidence
Has a section dedicated to this, complete with examples and tips.
Mappings
Closest match in ISO/IEC 27001: A.5.17, Management of authentication information, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.17.
ISM-1560 requires passwords used for MFA on SECRET systems to be at least 8 characters, establishing a baseline for authentication information quality. Annex A 5.17 focuses on the management process for allocating, controlling, and advising personnel on handling authentication information (including passwords), which helps ensure such length rules are defined, communicated, and enforced consistently. ISM-1560 is a specific technical requirement, while Annex A 5.17 is governance/process-oriented and does not itself set password length or SECRET-specific constraints.
This control partially meets A.8.5.
ISM-1560 sets a concrete authentication-strength requirement by mandating a minimum password length (8 characters) when passwords are used for MFA on SECRET systems. Annex A 8.5 requires implementing secure authentication technologies and procedures in line with access restrictions and access control policy, which would typically include specifying credential strength requirements. Annex A 8.5 is broader and risk-based, while ISM-1560 is a prescriptive, classification-specific parameter that can be used to satisfy part of Annex A 8.5.
ASD Essential Eight: 1 mapping
This control partially meets E8-MF-ML1.7.
ISM-1560 requires that passwords used as part of multi-factor authentication (MFA) on SECRET systems are at least 8 characters long. E8-MF-ML1.7 defines acceptable MFA factor combinations (e.g. something you have plus something you know/are), where the ISM password is an example of the "something you know" factor. E8-MF-ML1.7 is broader because it is about MFA composition, while ISM-1560 is a specific password-strength requirement within MFA for a specific classification context (SECRET).
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.