ASD ISM 1614 Manage emergency account access changes
What it says
Break glass account credentials are changed by the account custodian after they are accessed by any other party.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishChange break glass account passwords after emergency access.
In a nutshell, this control is about changing the passwords for special emergency accounts-called 'break glass accounts'-after they've been used by someone other than the person who normally manages them. This is crucial because if passwords aren't updated, it leaves the door open for potential misuse or unauthorised access to sensitive systems, which could lead to data breaches or disruptions.
Free. Save your status, tasks and notes.
Why it matters
Without changing break glass credentials after use, prior holders can re-enter systems, increasing the chance of unauthorised access, breaches and disruption.
How to implement
The IT team should identify all break glass accounts within the organisation.
This involves creating a list of these accounts and ensuring they are only used in genuine emergencies. Clarify which systems they provide access to and who is authorised to use them.
Managers should designate a custodian for each break glass account.
This custodian is the go-to person responsible for changing the account's password after every emergency use. Assign someone reliable and ensure they understand their role and responsibilities.
The custodian should change the password immediately after an emergency access event.
This involves logging into the system, updating the credential, and securely storing the new password. Make sure no other activity is conducted until the password change is confirmed.
The IT team should establish a secure procedure for recording when break glass accounts are used.
This could be done through a logbook or digital tracking system that records the date, time, and reason for access.
Staff training is crucial: Managers should organise regular training sessions for staff to understand when and how break glass accounts should be used and the importance of changing passwords afterwards.
Training should include how to recognise a genuine emergency.
Keep it running
After any break glass use, the account custodian must reset the password immediately, record the change in logs/tickets, and confirm access is returned to a known state.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The log of emergency access events: Request to see records that show when break glass accounts have been used.
Look at
The dates and times of these logs and who accessed the accounts.
Good evidence
Is a clear and detailed log showing proper documentation of each instance.
- Check 2 of 5What an auditor asks for
Ask for
Evidence of password changes: Check the records for confirmations of password updates after each emergency use.
Look at
The logs for any documentation, such as screenshots or automated logs, confirming the password change.
Good evidence
Is timely evidence showing passwords were promptly changed post-access.
- Check 3 of 5What an auditor asks for
Ask for
A list of all break glass accounts: Request a current list of all such accounts maintained by the organisation.
Look at
The completeness and accuracy of the list, ensuring it covers all critical systems.
Good evidence
Is a comprehensive list with up-to-date information.
- Check 4 of 5What an auditor asks for
Ask for
About staff training records: Request documentation of any training sessions held for staff about using break glass accounts.
Look at
The frequency and attendance of these sessions.
Good evidence
Is records showing regular training sessions with relevant staff attendance.
- Check 5 of 5What an auditor asks for
Ask for
A procedure document: Request the formal procedure for managing break glass accounts.
Look at
The document's details on who is responsible for updating passwords and how this is monitored.
Good evidence
Includes clear steps for maintaining security and evidence of regular procedure reviews.
Mappings
Closest match in ISO/IEC 27001: A.5.17, Management of authentication information, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.17.
ISM-1614 entails changing break glass credentials after emergency access by another party. Annex A 5.17 is broader, requiring a management process for authentication information across the organisation, including access change procedures like those in ISM-1614.
This control partially overlaps A.8.2.
ISM-1614 mandates changing break glass credentials after emergency access to mitigate credential exposure risk. Annex A 8.2 relates by requiring restricted and managed privileged access rights, which include managing break glass accounts.
ASD Essential Eight: 1 mapping
This control partially overlaps E8-RA-ML2.5.
ISM-1614 requires break glass account credentials to be changed by the account custodian after emergency access by any other party. E8-RA-ML2.5 relates by setting baseline strength and management expectations for break glass credentials, which aligns with the credentials ISM-1614 requires to be rotated after use.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.