ASD ISM 1596 Avoid reusing credentials across systems
What it says
Credentials are not reused by users across different systems.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUsers should not use the same passwords on different systems for better security.
This control is about not using the same password for different accounts or systems. It's important because if someone gets access to one password, they could break into all your accounts and do serious harm, like stealing money or sensitive information.
Free. Save your status, tasks and notes.
Why it matters
Reusing passwords increases the risk of credential stuffing, potentially causing financial loss or compromise of sensitive data across multiple systems.
How to implement
Office managers should arrange for a password management tool that can help employees create and store unique passwords for different accounts.
This can be done by researching options online and choosing a tool that balances price with the features your organisation needs.
HR should conduct a training session for employees to explain the risks of reusing passwords and how to use the new password management tool.
This session can be organised during a regular team meeting and recorded for those who cannot attend.
IT staff should guide employees on setting up the password manager on their devices, ensuring it's configured to generate strong passwords automatically.
This can be done via one-on-one desk visits or a virtual session using a video call platform.
Department heads should periodically remind their teams not to reuse passwords by sending out a monthly newsletter or email with security tips.
Include stories or examples of recent breaches caused by password reuse to highlight the risks.
Every manager should encourage the use of multi-factor authentication (MFA) wherever possible, explaining this adds an additional layer of protection.
This might involve turning on features in the systems used by the team or providing step-by-step guides on setting up MFA on their accounts.
Keep it running
Require unique passwords per system and promote password managers to generate/store strong credentials; block known-breached passwords to reduce reuse.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A list of systems and applications used: Verify if unique passwords are enforced across different systems.
Look at
User access policies that should dictate password guidelines.
Good evidence
A policy document highlighting unique password requirements for each system.
- Check 2 of 5What an auditor asks for
Ask for
Training records on password management: Check that all staff have completed training on this topic.
Look at
Up-to-date records showing participation in training sessions.
Good evidence
Comprehensive attendance logs or recordings from training sessions.
- Check 3 of 5What an auditor asks for
Look at
Evidence that passwords are not reused across different accounts.
Good evidence
Reports showing compliance with unique password creation.
- Check 4 of 5What an auditor asks for
Ask for
Documentation of security reminders sent out: Verify the frequency and content related to password reuse warnings.
Look at
Emails, newsletters, or other communication records sent to staff.
Good evidence
Consistent reminders with tips and examples, distributed on a regular basis.
- Check 5 of 5What an auditor asks for
Look at
A growing list of systems requiring MFA.
Good evidence
Documentation showing an increasing number of accounts secured by MFA, minimising risks from password reuse.
Mappings
Closest match in ISO/IEC 27001: A.5.17, Management of authentication information, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.5.17.
ISM-1596 requires that users do not reuse credentials across different systems to reduce the impact of credential compromise. Annex A 5.17 requires an organisation-managed process for allocating and managing authentication information (including guidance to personnel), within which prohibiting password reuse across systems is a common and appropriate handling rule. Annex A 5.17 is broader because it covers the full lifecycle and governance of authentication information beyond reuse (e.g. issue, storage, transmission, reset and user handling guidance).
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-13.6Enforce unique credentials per system and account, especially in high-privilege contextsPartially overlaps
This control partially overlaps IT.PRO-13.6.
IT.PRO-13.6 requires user, machine, system and service account credentials to be unique per system or account, especially where privileged; ISM-1596 requires users not to reuse credentials across different systems, covering the user side of that.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.