ASD ISM 2080 No password complexity requirements enforced
What it says
Password complexity requirements are not imposed for passwords.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishPasswords do not need to follow strict complexity rules.
This control means that when people are creating passwords, they don't have to make them complicated with a mix of letters, numbers, and symbols. If passwords are not strong enough, it becomes easier for hackers to guess them and gain access to confidential information, putting the whole organisation at risk.
Free. Save your status, tasks and notes.
Why it matters
Without password complexity requirements, users may choose weak passwords, making brute-force and credential guessing easier and increasing unauthorised access risk.
How to implement
System owners should review and understand the risks associated with simple passwords.
They can do this by consulting with IT security experts to learn about common threats and how strong passwords can mitigate these risks.
IT teams should create a user-friendly guide on password best practices.
This can be done by outlining simple rules for creating strong passwords, such as using a passphrase that includes a mix of unrelated words.
Managers should ensure that all staff are aware of password importance by organising a password workshop.
This workshop should cover why strong passwords are necessary and demonstrate how to create them.
Procurement officers should look for security tools that help enforce strong passwords.
They can achieve this by searching for tools with features that remind users to update their passwords regularly.
HR should incorporate password awareness into the onboarding process.
This can include giving new staff easy-to-understand instructions and ensuring they understand the risks of weak passwords.
Keep it running
Monitor for compromised credentials, enforce MFA, and use password screening against breached-password lists to reduce the impact of weak, user-chosen passwords.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The latest password policy document: Request the company's official guideline on how passwords should be created.
Look at
Any sections that mention criteria for passwords.
Good evidence
Is a document detailing recommendations for strong passwords, even if complexity isn't enforced.
- Check 2 of 5What an auditor asks for
Ask for
To see training records related to password security: Request logs or records of any training sessions held for staff.
Look at
Evidence that password best practices were included.
Good evidence
Is documentation showing that staff were informed about how to create strong passwords.
- Check 3 of 5What an auditor asks for
Ask for
Reports from any password management software: Request any reports generated by software that manages or monitors password usage.
Look at
Alert logs or compliance metrics.
Good evidence
Is detailed reports indicating password update reminders sent to users.
- Check 4 of 5What an auditor asks for
Ask for
Evidence of communication sent to staff about password guidelines: Request emails or memos circulated within the organisation.
Look at
Clear messages educating staff on why strong passwords matter.
Good evidence
Is multiple records showing consistent, ongoing communication.
- Check 5 of 5What an auditor asks for
Ask for
To see IT infrastructure access logs: Request access logs from the IT department.
Look at
Any unusual login attempts or patterns.
Good evidence
Shows active monitoring and investigation of suspicious activities.
Mappings
Closest match in ISO/IEC 27001: A.5.15, Access control policies and procedures, which partially overlaps with this control.
ISO/IEC 27001: 2 mappings
This control partially overlaps A.5.15.
ISM-2080 states that password complexity requirements are not imposed for passwords. Annex A 5.15 requires an organisation to establish and implement access control policies and procedures, within which password composition rules (or the deliberate choice not to enforce them) would typically be defined. Annex A 5.15 is broader because it covers access control governance across physical and logical access, not just password complexity decisions.
This control partially overlaps A.5.17.
ISM-2080 specifies that organisations do not enforce password complexity requirements. Annex A 5.17 requires controlled allocation and management of authentication information, which includes governing password issuance, reset, storage, and user guidance, where complexity rules (or their absence) are part of the managed approach. Annex A 5.17 is broader because it covers the full management lifecycle of authentication information beyond password composition requirements.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.