ASD ISM 1953 Ensure strong management of admin account credentials
What it says
Credentials for the built-in Administrator account in each domain are long, unique, unpredictable and managed.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishMake sure admin account passwords in each domain are long, unique, and securely managed.
This control is about making sure the administrator accounts used to run your computer networks have passwords that are long, unique, and handled securely. This matters because weak or shared passwords make it easy for hackers to break into your systems, potentially leading to theft of sensitive information or disruption of services.
Free. Save your status, tasks and notes.
Why it matters
Weak or reused built-in domain Administrator credentials enable domain compromise, privilege escalation and widespread service disruption.
How to implement
The IT team should create strong passwords for admin accounts.
They can do this by using password management software to generate long and unique passwords that aren't easy to guess.
System owners need to ensure each admin account is tied to a specific person rather than using generic accounts.
This involves assigning admin accounts by individual names and ensuring they are only used by authorised personnel.
Managers should review who has access to admin accounts regularly.
To do this, schedule quarterly meetings with the IT team to review user access logs and make sure only the right people have access.
HR, along with the IT team, should implement a process to immediately update passwords when staff leave.
This can be achieved by integrating account update tasks into the employee exit process.
The IT team should use multi-factor authentication (MFA) for admin accounts.
This means setting up an additional step when logging in, like a mobile app code, besides the password itself.
Keep it running
Ensure each domain's built-in Administrator password is long, unique and stored in a vault; rotate regularly and after suspected compromise.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The password policy document: Request the official policy on password requirements for admin accounts.
Look at
The specifics on length, complexity, and renewal frequency.
Good evidence
Policy will have a clear requirement for long, complex passwords that are changed regularly.
- Check 2 of 5What an auditor asks for
Ask for
A recent admin user list with access dates: Check when each admin last changed their password. Good practice is shown by recent password changes that comply with the organisation's policy.
- Check 3 of 5What an auditor asks for
Ask for
A record of MFA implementation for admin accounts: Review documents showing which admin accounts have MFA enabled.
Look at
Evidence that all admin accounts have MFA set up, indicating strong account security.
- Check 4 of 5What an auditor asks for
Ask for
Access audit logs: Review logs detailing who accessed admin accounts and when. Good logs show regular reviews of who is accessing sensitive accounts and any unusual login attempts.
- Check 5 of 5What an auditor asks for
Ask for
The process document for handling admin account changes post-employment: Check that this process includes steps for promptly changing passwords when someone leaves. Good practice means all admin accounts have updated passwords within a day of employee departure.
Mappings
Closest match in ISO/IEC 27001: A.5.17, Management of authentication information, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.5.17.
ISM-1953 mandates that credentials for the built-in Administrator account in each domain are long, unique, unpredictable and managed. Annex A 5.17 is broader than ISM-1953, requiring an organisational process for allocation and management of authentication information across users and systems, including guidance on appropriate handling. ISM-1953 is a specific, high-risk application of Annex A 5.17's general authentication-information management expectations focused on one critical account type.
ASD Essential Eight: 1 mapping
This control partially overlaps E8-RA-ML2.5.
ISM-1953 requires credentials for the built-in Administrator account in each domain to be long, unique, unpredictable and managed. E8-RA-ML2.5 directly covers the same credential-quality and management expectations, but applies them to a broader set of high-risk accounts (break glass, local administrator and service accounts). The overlap is strongest for domain/local administrator credentials, while E8-RA-ML2.5 extends beyond ISM-1953's built-in domain Administrator focus.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-13.6Enforce unique credentials per system and account, especially in high-privilege contextsPartially overlaps
This control partially overlaps IT.PRO-13.6.
IT.PRO-13.6 requires user, machine, system and service account credentials to be unique per system or account, especially where privileged; ISM-1953 requires each domain's built-in Administrator account credentials to be long, unique, unpredictable and managed, a specific high-privilege case.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.