ASD ISM 1954 Enforce random credentials for administrator accounts
What it says
Credentials for built-in Administrator accounts, break glass accounts, local administrator accounts and service accounts are randomly generated.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure admin and service account passwords are randomly generated to improve security.
This control means that passwords for important accounts, like administrators who manage your computer systems, should be randomly generated instead of being chosen by people. This is important because if someone guesses or steals a simple password, they could take control of your systems and data, causing financial and operational problems.
Free. Save your status, tasks and notes.
Why it matters
If administrator, break glass, local admin and service account passwords are not randomly generated, attackers can guess/reuse them to gain privileged access and cause data breaches.
How to implement
The IT team should use a password management tool to generate passwords for all administrator accounts.
This tool can create complex passwords that are hard to guess and manage these securely for the team.
Business owners should ensure that admin and service account passwords are changed regularly using a random generator.
This involves setting up a schedule to automatically change these passwords every few months.
Employees responsible for IT should implement policies requiring random password generation for service accounts.
This can be done by configuring your systems and software to only allow passwords generated by a password manager.
System administrators should educate users about the importance of random passwords through a training session.
This session can include a demonstration of password generation tools and the risks of weak passwords.
The security manager should review and update the organisation's password policy to include random password generation as a requirement.
This involves documenting the process and ensuring access to necessary tools for all relevant staff.
Keep it running
Use a password vault/LAPS to randomly generate and rotate credentials for built-in Administrator, break glass, local admin and service accounts; audit for reuse and enforce rotation.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The list of current passwords for admin accounts: Request evidence of recent password changes.
Look at
Whether these passwords were generated using a random tool.
Good evidence
Passwords shown as auto-generated with the tool's name and change date.
- Check 2 of 5What an auditor asks for
Ask for
The password policy document: Ask if it states the requirement for passwords to be randomly generated.
Look at
Details about implementation and compliance checks.
Good evidence
Policy text explaining random generation is mandatory and tools used.
- Check 3 of 5What an auditor asks for
Ask for
Training session records: Request documents or presentations used to educate staff about random password policies.
Look at
Attendance records and content about password safety.
Good evidence
Materials include why random passwords matter and show attendance records.
- Check 4 of 5What an auditor asks for
Ask for
Logs of password changes in systems: Request IT system logs that show when and how passwords were updated.
Look at
Timestamps and notes about the generation method.
Good evidence
Logs show regular changes and indicate automated or random generation.
- Check 5 of 5What an auditor asks for
Ask for
A review or audit report of passwords: Request any recent assessments of password security practices.
Look at
Analysis of compliance with random generation guidelines.
Good evidence
Report shows regular assessments and compliance with randomisation.
Mappings
Closest match in ASD Essential Eight: E8-RA-ML2.5, Long, unique, and managed credentials for admin accounts, which asks for the same thing.
ASD Essential Eight: 1 mapping
This control is equivalent to E8-RA-ML2.5.
ISM-1954 requires credentials for built-in Administrator, break glass, local administrator and service accounts to be randomly generated. E8-RA-ML2.5 requires those same account types to use long, unique, unpredictable, managed credentials, which in practice is achieved by random generation and managed storage/rotation. E8-RA-ML2.5 adds explicit strength/management characteristics (long and managed), while ISM-1954 is specifically framed as random generation.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.