ASD ISM 2044 Prevent default credentials in software installations
What it says
Software has no default credentials; however, if credentials are required, they are created on first install by the installing organisation.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure software does not come with default passwords; new credentials are set during installation.
Setting up software with default passwords is risky because hackers can easily guess or find these common passwords online, just like a skeleton key that opens many doors. To stay secure, it's crucial to create unique passwords for each new software installation, preventing unauthorised access and potential data breaches.
Free. Save your status, tasks and notes.
Why it matters
Default credentials let attackers guess or reuse logins to gain unauthorised access, leading to data compromise and service disruption.
How to implement
The IT team should create installation guidelines: Develop a step-by-step guide that ensures software installations do not use default passwords.
Include instructions on generating strong, unique passwords during setup.
System managers should oversee installations: Ensure software installations are monitored to confirm new passwords are set.
Host an installation session with a checklist to verify all steps are followed.
Procurement officers should communicate with vendors: When buying software, ask vendors if their software includes default credentials.
Choose software that requires new credentials to be set during the first installation.
The IT security team should train staff: Conduct training sessions to educate employees on the importance of setting secure passwords during installations.
Include practical exercises on creating strong passwords.
Administrators should implement password management tools: Use password managers to securely generate and store passwords.
Ensure all software credentials are stored safely and only accessible to authorised personnel.
Keep it running
On first install, create unique admin credentials (no vendor defaults), store them in a password manager, and verify all default accounts are removed/disabled.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The installation checklist: Request documentation that outlines each step followed during software installation.
Look at
Evidence that no default passwords were used, such as a tick box or note confirming new credentials were set.
Good evidence
Is a completed checklist signed by an IT staff member.
- Check 2 of 5What an auditor asks for
Ask for
Software procurement records: Request records that show communication with vendors about default credential policies.
Look at
Confirmation that the software procured requires new credentials.
Good evidence
Includes emails or written statements from the vendor.
- Check 3 of 5What an auditor asks for
Ask for
To see training session records: Review attendance sheets and training materials used to educate staff on secure installations.
Look at
Records of staff participation and clear guidance on setting new passwords.
Good evidence
Is training logs showing attendance and feedback.
- Check 4 of 5What an auditor asks for
Ask for
A sample password report: Request a review of password strength used in recent installations.
Look at
Reports demonstrating that passwords follow best practices for complexity and uniqueness.
Good evidence
Is a report confirming compliance with internal policies.
- Check 5 of 5What an auditor asks for
Ask for
A demonstration of the password manager in use: Observe how passwords are generated and stored within the tool.
Look at
A secure, user-friendly process accessible only to those who need it.
Good evidence
Is a demonstration showing efficiency and security features.
Mappings
Closest match in ISO/IEC 27001: A.5.17, Management of authentication information, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.5.17.
ISM-2044 requires software installations to avoid default credentials and to create credentials on first install by the installing organisation. Annex A 5.17 requires a controlled process for allocation and management of authentication information, which includes establishing, issuing and protecting credentials across their lifecycle. Annex A 5.17 is broader because it extends well beyond installation (ongoing management, communication and handling of authentication information), whereas ISM-2044 targets a specific control point: initial credential creation and the elimination of vendor defaults.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.