ASD ISM 1955 Regularly change compromised credentials
What it says
Credentials for computer accounts are changed if they are compromised, they are suspected of being compromised or they have not been changed in the past 30 days.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishChange computer account passwords every 30 days or if they're compromised or suspected to be.
This rule is about regularly changing your computer account passwords, especially if they're compromised or might be. It's important because if someone else gets your password, they could access all your sensitive information and misuse it before you even realise there's a problem.
Free. Save your status, tasks and notes.
Why it matters
Failure to change compromised or stale computer account credentials can enable unauthorised access, data breaches and service misuse within days.
How to implement
The IT team should set up an automatic reminder system: Use calendar alerts or an email reminder system for people to change their passwords every 30 days.
Send these reminders a few days before passwords are due to be changed to ensure timely updates.
The IT manager should maintain a compromised credentials policy: Set clear steps on how to promptly change passwords when there's a suspicion or confirmation of a breach.
Make this process simple and easy for all staff to follow, including who to contact and what to do immediately.
Office managers should conduct regular training: Ensure staff understand how to recognise signs that a password might be compromised, like receiving password reset emails they didn't request.
Provide practical examples in training sessions to make this relatable.
HR departments should handle new and departing employees: Make sure new staff know how to set up secure passwords and understand the change policy upon joining.
For departing staff, ensure accounts are immediately locked and passwords changed.
Team leaders should encourage password managers: Recommend using a password manager to make frequent password changes easier for everyone.
Explain how these tools can securely store multiple passwords and generate strong ones automatically.
Keep it running
Change computer account credentials immediately on suspected/confirmed compromise, and enforce rotation so they are changed at least every 30 days (e.g., scheduled tasks with alerts).
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Password change alerts: Request evidence of the email or calendar reminders used to notify staff about password changes.
Look at
Alerts being sent out at least every 30 days.
Good evidence
Would be records showing timely notifications sent to all employees.
- Check 2 of 5What an auditor asks for
Ask for
The compromised credentials policy: Request the document that outlines the procedure for when passwords are suspected of being compromised.
Look at
Clear guidelines, contact details, and action steps.
Good evidence
Is a concise, step-by-step policy document easily accessible by staff.
- Check 3 of 5What an auditor asks for
Ask for
Training materials or records: Request copies of recent training session outlines or attendance records.
Look at
How often the training occurs and if it covers password security and handling breaches.
Good evidence
Includes regular sessions with up-to-date content tailored to organisational needs.
- Check 4 of 5What an auditor asks for
Ask for
Onboarding and offboarding procedures: Request evidence of standard procedures for new and departing employees related to password management.
Look at
Consistency in handling changes effectively.
Good evidence
Includes clear steps for creating and removing access, and timely password resets.
- Check 5 of 5What an auditor asks for
Ask for
Password manager usage policy: Request information or guidelines provided to staff on using password managers.
Look at
How these tools are recommended and supported by the organisation.
Good evidence
Shows an endorsed list of password managers and user guides available to staff.
Mappings
Closest match in ISO/IEC 27001: A.5.17, Management of authentication information, which partially overlaps with this control.
ISO/IEC 27001: 2 mappings
This control partially overlaps A.5.17.
Annex A 5.17 requires organisations to control the allocation and management of authentication information through a defined process, including handling and maintenance of credentials. ISM-1955 relates by requiring computer account credentials to be changed when compromised or suspected compromised, and otherwise within a specified timeframe, which is a concrete lifecycle management activity for authentication information. ISM-1955 is narrowly focused on rotation/change conditions for computer accounts, while Annex A 5.17 is broader and covers issuance, secure storage, distribution and user guidance across all authentication information types.
This control depends on A.5.26.
ISM-1955 requires organisations to promptly change computer account credentials when compromise is suspected/confirmed, as well as on a 30-day cycle. This supports Annex A 5.26 because credential resets are a common containment and recovery action within incident response procedures. Annex A 5.26 is broader (covering end-to-end incident response), while ISM-1955 focuses specifically on one credential-focused response and hygiene measure.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.