ASD ISM 1806 Change default user credentials during setup
What it says
Default user accounts or credentials for user applications, including for any pre-configured user accounts, are changed, disabled or removed during initial setup.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishChange or remove default user accounts when setting up applications to enhance security.
When setting up new software or systems, it's important to change or remove any user accounts or passwords that come pre-installed. Hackers often know these default accounts and can use them to break into your system, putting your information at risk. By changing them, you're adding an extra layer of security right from the start.
Free. Save your status, tasks and notes.
Why it matters
If default credentials remain unchanged, attackers can log in using publicly known vendor defaults, leading to unauthorised access and data breaches.
How to implement
System owners should ensure any new software or hardware is reviewed immediately after installation.
Check for any user accounts that came with the system and document them. Work closely with IT specialists to change these account passwords or delete the accounts if they are not needed.
IT teams should document a standard procedure for updating or removing pre-configured user accounts on all new systems.
This procedure could be a checklist that is updated regularly and shared with all IT staff. Make sure this becomes a standard part of the setup process.
Managers should support training for all relevant staff on the importance of changing default user credentials.
Arrange a training session where IT explains the risks of leaving default accounts unchanged and demonstrates how to identify and modify these accounts.
Procurement teams should liaise with vendors to understand any default credentials included with purchased systems.
Request documentation from vendors that lists all default accounts so that these can be identified and managed during installation.
Audit and compliance officers should conduct regular checks to ensure that default account settings have been changed.
Develop a schedule where systems are randomly checked for compliance and maintain records of these audits for tracking purposes.
Keep it running
During commissioning, change or disable all vendor default accounts (including built-in and pre-configured users) and verify with periodic account audits and login tests.
Evidence and audit
- Check 1 of 4What an auditor asks for
Ask for
The setup procedure document: Request to see the checklist or written procedure that includes steps for changing default credentials during setup.
Look at
Whether the document is comprehensive and up to date.
Good evidence
Is a clearly detailed procedure that includes changing or removing default user accounts.
- Check 2 of 4What an auditor asks for
Ask for
Documentation of user account changes during recent system setups: Request logs or records showing user account setups and modifications.
Look at
How these changes are logged, verified, and dated. Good practice includes detailed records that match the procedure and show all default accounts dealt with appropriately.
Good evidence
Is a complete list that shows a match between new systems and changes in default account settings.
- Check 3 of 4What an auditor asks for
Ask for
Evidence of training sessions: Request a record of training sessions provided to staff about managing default user credentials.
Look at
Session dates, attendance records, and any materials used.
Good evidence
Sign is regular training with widespread attendance among relevant personnel.
- Check 4 of 4What an auditor asks for
Ask for
Vendor-provided documentation: Request any documentation vendors provided with new systems concerning default accounts.
Look at
Whether it includes all relevant information about default setup and any guidance on changing these credentials. Good practice shows confirmed vendor communication and documented follow-through changes as per guidance.
Mappings
Closest match in ISO/IEC 27001: A.8.9, Configuration management for secure IT systems, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.9.
ISM-1806 requires default user accounts and credentials in user applications to be changed, disabled, or removed during initial setup. Annex A 8.9 requires organisations to establish, document, implement, monitor and review configuration (including security configuration) across systems and services, which would include removing or changing default credentials as a baseline configuration task. ISM-1806 is a specific configuration hardening requirement focused on initial credential state, whereas Annex A 8.9 is broader lifecycle configuration management.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.