ASD ISM 1795 Set 30-character minimum for key administrator passwords
What it says
Credentials for built-in Administrator accounts, break glass accounts, local administrator accounts and service accounts are a minimum of 30 characters.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure key system accounts use passwords that are at least 30 characters long to enhance security.
This control is about making sure important system accounts have strong passwords that are at least 30 characters long. It's crucial because weak passwords can be easily guessed or cracked by attackers, which might allow them to access and control your systems, leading to data breaches or operational disruptions.
Free. Save your status, tasks and notes.
Why it matters
If Administrator, break-glass, local admin or service account passwords are under 30 characters, attackers can brute-force or spray credentials and gain full administrative control.
How to implement
The IT team should update the password policy to require a minimum of 30 characters for all key administrator accounts.
They can do this by accessing the password settings in the system configuration tool and adjusting the minimum password length to 30 characters.
System administrators should communicate the importance of using long and complex passphrases to all users with access to key accounts.
This can be done through training sessions or email reminders explaining how to create memorable yet complex passwords that meet the length requirement.
The IT team should implement a password management tool that enforces the 30-character rule.
They can select and set up a tool that automatically checks password length and helps users generate strong passwords.
Managers should schedule regular password audits to ensure compliance.
They should meet with IT twice a year to review password policies and gather reports showing that passwords meet the length requirement.
System owners should disable or modify default administrator accounts to require 30-character passwords.
This involves checking all systems for default accounts and updating their password settings accordingly.
Keep it running
Enforce a 30+ character minimum for built-in Administrator, break-glass, local admin and service accounts; routinely audit and rotate them using a password manager.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The password policy document: Request evidence of the current password policy that specifies the 30-character requirement.
Look at
The policy details to confirm the minimum password length is correctly set to 30.
Good evidence
Would show a policy document last reviewed within the past year with clear mention of the minimum character length.
- Check 2 of 5What an auditor asks for
Ask for
A report from the password management tool: Request a report demonstrating compliance with the 30-character rule for all key accounts.
Look at
Entries that show the actual password lengths used.
Good evidence
Would indicate that all key accounts have passwords meeting or exceeding the 30-character length.
- Check 3 of 5What an auditor asks for
Ask for
To see training materials or communications regarding password complexity: Review emails or training session content sent to users with access to key accounts.
Look at
Guidance that explains the importance of using long passwords and provides tips on how to create them.
Good evidence
Includes clear instructions tailored to non-technical staff.
- Check 4 of 5What an auditor asks for
Ask for
The audit schedule and results: Request records of past audits on password compliance.
Look at
Documentation of when audits occurred, what was checked, and any corrective actions taken.
Good evidence
Includes recent audit dates with findings that indicate compliance or actions planned to address gaps.
- Check 5 of 5What an auditor asks for
Ask for
Evidence of disabling or modifying default administrator accounts: Request a list of such accounts with current password policies.
Look at
Changes made to default configurations to enforce the password length.
Good evidence
Would confirm these accounts have unique passwords meeting the 30-character requirement.
Mappings
Closest match in ASD Essential Eight: E8-RA-ML2.5, Long, unique, and managed credentials for admin accounts, which this control partially meets.
ASD Essential Eight: 1 mapping
This control partially meets E8-RA-ML2.5.
ISM-1795 requires credentials for built-in Administrator accounts, break glass accounts, local administrator accounts and service accounts to be a minimum of 30 characters. E8-RA-ML2.5 requires those same high-risk admin account credentials to be long, unique, unpredictable and managed, which includes (but does not quantify) password length. ISM-1795 is a specific, measurable password-length requirement within the broader credential quality and management expectations of E8-RA-ML2.5.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.