ASD ISM 1685 Strengthening passwords for critical accounts
What it says
Credentials for break glass accounts, local administrator accounts and service accounts are long, unique, unpredictable and managed.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure passwords for high-risk accounts are strong, unique, and properly managed.
This control is about ensuring that important accounts, which have powerful access to your systems, have strong, unique passwords that are kept safe. It's important because if these accounts are compromised, your entire organisation could be at risk of data theft, financial loss, or operational downtime.
Free. Save your status, tasks and notes.
Why it matters
Weak or reused passwords for break glass, local admin and service accounts enable easy compromise, leading to unauthorised privileged access, breaches and major financial/reputational damage.
How to implement
IT manager: Ensure all critical accounts like admin and service accounts have a password policy requiring long and unique passwords.
Use a password manager to generate and store passwords securely, avoiding predictable sequences.
System administrator: Regularly review and update passwords for high-risk accounts, setting reminders for when passwords need to change.
This can be done by setting expiration alerts within your password management tool.
Business owner: Educate staff on the importance of password security for critical accounts by organising a short seminar or training session.
Provide examples of potential risks and the impact of weak passwords.
Security officer: Monitor accounts for unusual activities that may indicate compromise.
Set up notifications for failed login attempts or sudden changes in account behaviour.
IT support team: Implement two-factor authentication (2FA) for all high-risk accounts to add an extra layer of security.
Provide a simple guide to help users set up 2FA on their devices.
Keep it running
For break glass, local admin and service accounts, enforce long unique passwords, store in an approved vault, rotate routinely and on staff changes, and restrict/monitor access.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The password policy document: Review the policy to ensure it specifies requirements for length, complexity, uniqueness, and change frequency for critical accounts.
Good evidence
A detailed policy document that specifies requirements and is regularly updated.
- Check 2 of 5What an auditor asks for
Ask for
A demonstration of the password vault.
Look at
The password manager software being used, ensuring it securely stores passwords and requires strong authentication to access. Good use of a password manager would show strong, unique passwords for every critical account.
- Check 3 of 5What an auditor asks for
Ask for
A training report on password security.
Look at
Records of past training sessions, including attendance logs and training materials. Good records show regular sessions and high participation rates.
- Check 4 of 5What an auditor asks for
Ask for
Monitoring and alert logs: Examine logs for records of potential security breaches or attempts. Good logs would show prompt investigation and response to unusual activities.
- Check 5 of 5What an auditor asks for
Ask for
Records of 2FA implementation: Verify that all high-risk accounts have 2FA enabled by checking account settings or authorisation logs. Good evidence would show majority coverage of 2FA across all critical accounts.
Mappings
Closest match in ASD Essential Eight: E8-RA-ML2.5, Long, unique, and managed credentials for admin accounts, which asks for the same thing.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.2.
ISM-1685 requires that critical account credentials (break glass, local administrator and service accounts) are long, unique, unpredictable and managed. Annex A 8.2 requires privileged access rights to be restricted and managed, focusing on authorisation and governance of privileged rights rather than credential strength. Strong, well-managed privileged credentials under ISM-1685 strengthen the effectiveness of privileged access management under Annex A 8.2, but do not cover its full allocation/use lifecycle requirements.
This control partially overlaps A.5.17.
Annex A 5.17 requires a managed process for allocating and controlling authentication information and advising personnel on secure handling. ISM-1685 relates by mandating that credentials for break glass, local administrator and service accounts are long, unique, unpredictable and managed, which is a specialised instance of strong authentication information management. ISM-1685 is scoped to privileged/critical accounts and credential properties, while Annex A 5.17 is broader and applies across credential lifecycle and all user populations.
ASD Essential Eight: 1 mapping
This control is equivalent to E8-RA-ML2.5.
ISM-1685 requires that credentials for break glass accounts, local administrator accounts and service accounts are long, unique, unpredictable and managed. E8-RA-ML2.5 states the same requirement for the same high-risk account types, including the management expectation. The controls are aligned in scope and intent such that implementing E8-RA-ML2.5 would substantially satisfy ISM-1685.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.