ASD ISM 2079 Ensure password length is at least 64 characters
What it says
Maximum length limits for passwords are not less than 64 characters.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishPasswords must allow a maximum length of at least 64 characters for increased security.
This control means that you should allow users to create passwords that are up to 64 characters long. It's important because longer passwords can significantly increase security by making it harder for hackers to guess or crack them, protecting sensitive information and data from being stolen.
Free. Save your status, tasks and notes.
Why it matters
If systems cap passwords below 64 characters, users must choose shorter secrets, reducing entropy and making brute-force and credential-stuffing attacks more likely to succeed.
How to implement
The IT team should review the current password policy.
They need to ensure that the system settings allow for passwords up to 64 characters in length. This might involve adjusting what is called the 'maximum password length setting' in your systems.
Managers should communicate the new password policy to all staff.
They should explain the benefits of using longer passwords and provide examples of how to create memorable but lengthy passwords to encourage adoption.
The HR team should update onboarding materials.
New employees should be informed of the password requirements during their initial training to ensure they understand the importance and method of creating secure passwords.
System administrators should test the system to confirm that there are no technical issues with longer passwords.
This involves creating test accounts and trying to set passwords of varying lengths to ensure the system handles them correctly.
The security officer should schedule routine checks.
These checks are to ensure that the maximum password length setting remains in place and to address any compliance issues promptly.
Keep it running
Confirm all authentication components (apps, IdPs, directories, gateways) allow at least 64-character passwords, and periodically test enforcement after upgrades or configuration changes.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The password policy document: Request the documented policy that outlines password requirements for users.
Look at
The section on maximum password length.
Good evidence
The document states clearly that passwords can be up to 64 characters long.
- Check 2 of 5What an auditor asks for
Ask for
A demonstration of password settings: Request that a system administrator shows you the settings in the system.
Look at
The configuration screen where password settings are defined.
Good evidence
The screen displays a setting that allows passwords up to 64 characters.
- Check 3 of 5What an auditor asks for
Ask for
Employee training records: Request proof that staff have been informed about the new password policy.
Look at
Training logs or attendance records.
Good evidence
Records showing that training sessions included discussion of the 64-character password policy.
- Check 4 of 5What an auditor asks for
Ask for
System logs: Request logs showing recent password changes.
Look at
The character length of passwords set by users.
Good evidence
Logs show users setting passwords that are long, indicating they have the ability to set longer passwords.
- Check 5 of 5What an auditor asks for
Ask for
System documentation: Request any technical documentation that supports system configurations.
Look at
Sections detailing password settings.
Good evidence
Documentation clearly mentions that the system allows for passwords up to 64 characters.
Mappings
Closest match in ISO/IEC 27001: A.5.17, Management of authentication information, which partially overlaps with this control.
ISO/IEC 27001: 1 mapping
This control partially overlaps A.5.17.
Annex A 5.17 requires a management process to control authentication information, including communicating appropriate handling requirements to personnel. ISM-2079 relates by requiring password systems not to impose a maximum length limit below 64 characters, which is a technical policy setting that supports secure password handling and reduces forced password truncation risks. ISM-2079 is a specific system configuration requirement, whereas Annex A 5.17 is broader and includes governance and lifecycle management beyond password field constraints.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.