ASD ISM 1561 Ensure strong passwords for TOP SECRET systems
What it says
Passwords used for multi-factor authentication on TOP SECRET systems are a minimum of 10 characters.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishTOP SECRET systems must use passwords of at least 10 characters for added security.
Ensuring strong passwords on TOP SECRET systems is crucial because it makes it much harder for outsiders to guess or crack them. If someone guesses a password, they could access sensitive information and potentially cause serious harm to your organisation. This control requires that passwords in use for multi-factor authentication (where more than just a password is needed to log in) are at least 10 characters long, adding an important layer of security.
Free. Save your status, tasks and notes.
Why it matters
Weak passwords for TOP SECRET MFA could enable unauthorised access, exposing highly sensitive data and potentially jeopardising national security operations.
How to implement
The IT team should set up all accounts related to TOP SECRET systems to require passwords of at least 10 characters.
They can do this by configuring the system settings to enforce this rule when new passwords are created or old ones are changed.
System owners need to ensure that their users understand the importance of strong passwords.
They can organise short training sessions to demonstrate how to create passwords that are both long and easy to remember, using phrases or a mix of words and numbers.
Managers should regularly remind staff to avoid common passwords or words related to their personal life.
They can send out monthly reminders through emails or meetings, giving examples of strong passwords and explaining the risks of weak ones.
The cyber security team should implement checks to automatically monitor and alert if any known weak passwords are used on the system.
This can be done using security software that flags insecure passwords for further review.
Human Resources should include password best practices and the 10-character requirement in the employee onboarding process.
New staff should sign a document acknowledging they understand and will follow these practices.
Keep it running
Audit TOP SECRET MFA password length to ensure a 10+ character minimum; enforce policy and technical controls, and remediate any non-compliant accounts.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The system configuration settings: Request a screenshot or printout of the authentication settings that show the password requirements.
Look at
The section that specifies password length.
Good evidence
It clearly states 'min. 10 characters' for systems handling TOP SECRET data.
- Check 2 of 5What an auditor asks for
Ask for
The training schedule or material: Request documentation or a calendar showing when employees receive training about password security.
Look at
Details that specify coverage of strong password creation.
Good evidence
Shows training was conducted before system access was provided and regularly updated.
- Check 3 of 5What an auditor asks for
Ask for
Logs or reports from the security software that flags weak passwords.
Look at
A sample of these reports over the past few months.
Good evidence
Shows consistent monitoring activity and actions taken on any alerts.
- Check 4 of 5What an auditor asks for
Ask for
An onboarding checklist: Request to see the document that HR uses to onboard new staff.
Look at
An explicit item on confirming understanding of password policies.
Good evidence
New employee files have signed checklists acknowledging password rules.
- Check 5 of 5What an auditor asks for
Ask for
Copies of recent emails or meeting notes that mention the password length requirement.
Look at
Evidence that this was communicated regularly and to all relevant team members.
Good evidence
Shows consistent communication with acknowledgment from recipients.
Mappings
Closest match in ISO/IEC 27001: A.5.17, Management of authentication information, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.5.17.
ISM-1561 requires that passwords used as part of multi-factor authentication on TOP SECRET systems are at least 10 characters long. This relates to ISO/IEC 27001:2022 Annex A 5.17 because it is a specific authentication-information management rule (a password strength parameter) that would be set and governed under that management process. Annex A 5.17 is broader, covering allocation, handling and governance of authentication information generally, not prescribing a specific password length or TOP SECRET scoping.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.