ASD ISM 2076 Eliminating security questions for authentication
What it says
Security questions are not used for authentication purposes.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishAuthentication should not use security questions as they can be easily compromised.
This control is about stopping the use of security questions to verify someone's identity. These questions, like 'What is your mother's maiden name?', can be easily guessed or found out by others, putting your data at risk. If you keep using them, someone could pretend to be you and access sensitive information or take harmful actions without your knowledge.
Free. Save your status, tasks and notes.
Why it matters
If security questions remain, attackers can guess or obtain answers and reset accounts, causing unauthorised access and data breaches.
How to implement
IT manager should review current authentication processes: Start by checking whether any of your systems still rely on security questions for login or account recovery.
Identify each system that uses them and document where changes are needed.
System administrators should disable security questions: Replace security question-based authentication with more secure methods like two-factor authentication (2FA), which involves something you know and something you have, like a confirmation code sent to your phone.
Business owners must liaise with service providers: For any third-party systems that use security questions, contact the vendors to discuss upgrading to more secure authentication methods.
Request detailed guidance on how to switch to these stronger security measures.
HR should educate staff: Ensure all employees know about the change away from security questions and why it's crucial, using clear, non-technical explanations.
Regularly remind them of safer practices to keep their accounts secure.
Communications teams should update your policies and materials: Refresh any documentation or user guides to reflect the removal of security questions.
Clearly outline new authentication processes to avoid confusion.
Keep it running
Audit authentication and account recovery flows to ensure security questions are removed and no fallback prompts appear in apps or helpdesk scripts.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A list of authentication methods: Request documentation showing all methods currently in use for verifying users' identities.
Look at
The details to confirm that security questions are not listed as an option.
Good evidence
Will show updated methods such as two-factor authentication, with no mention of security questions.
- Check 2 of 5What an auditor asks for
Ask for
System change logs: Request records showing recent changes to authentication settings. Look to see that security questions have been removed and that two-factor authentication or similar has been added.
Good evidence
Log will have clear entries showing these updates with relevant dates.
- Check 3 of 5What an auditor asks for
Ask for
A staff communication record: Request evidence that staff have been informed about the change in authentication methods.
Look at
Emails, meeting notes, or training logs detailing the new procedures.
Good evidence
Will have clear messages sent to all employees with explanations of the change.
- Check 4 of 5What an auditor asks for
Ask for
Updated security policies: Request the most recent versions of authentication policies. Look to ensure that the policy no longer includes security questions as a method.
Good evidence
Policy will outline secure methods like two-factor authentication.
- Check 5 of 5What an auditor asks for
Ask for
Vendor communication records: Request a record of any communication with third-party vendors about removing security questions.
Look at
Confirmations from vendors agreeing to disable security questions.
Good evidence
Will include emails or letters from vendors confirming the changes and implementation plans.
Mappings
Closest match in ISO/IEC 27001: A.5.17, Management of authentication information, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.17.
ISM-2076 prohibits using security questions as an authentication mechanism. ISO/IEC 27001:2022 Annex A 5.17 requires organisations to control the allocation and management of authentication information, which can include defining what forms of authentication information are permitted and how they are handled. Annex A 5.17 is broader and process-focused, whereas ISM-2076 is a specific control decision about excluding security questions from the authentication design.
This control partially meets A.8.5.
ISM-2076 requires that security questions are not used for authentication purposes. ISO/IEC 27001:2022 Annex A 8.5 requires secure authentication technologies and procedures to be implemented based on access restrictions and access control policy, which would typically include disallowing weak authenticators such as security questions. Annex A 8.5 is broader because it covers selection and implementation of authentication methods generally, while ISM-2076 is a specific prohibition of one method.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.