ASD ISM 2081 Enforce use of all ASCII characters in passwords
What it says
All ASCII printable characters are supported for passwords.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishAllow any printable character to be used in passwords for increased complexity.
Allowing all printable characters for passwords means you can use anything you can type on your keyboard, like symbols and punctuation, not just letters and numbers. This matters because a password with a mix of characters is much harder for hackers to guess, which keeps your accounts safer.
Free. Save your status, tasks and notes.
Why it matters
If passwords can't use all ASCII printable characters, users are forced into predictable patterns and reduced entropy, increasing susceptibility to guessing and brute-force attacks.
How to implement
System owners should update password policies to include all ASCII characters as allowed choices.
They can do this by working with the IT team to configure the system settings where passwords are created, so that any printable character can be used.
IT teams should educate staff on the importance of using diverse characters in passwords.
They can hold short training sessions showing how to use symbols, numbers, and letters creatively to make passwords stronger.
Managers should ensure that new staff are briefed on strong password creation as part of onboarding.
This can be done by integrating a password creation guide into the onboarding checklist that explains how to choose a strong password using a mix of characters.
IT security leads should run periodic checks on systems to ensure they're accepting all ASCII characters in passwords.
This involves testing the password system by attempting to set passwords with a variety of symbols, numbers, and letters.
HR should update all company policies and training materials to reflect the change in password requirements.
They can do this by reviewing current documents and inserting clear instructions and examples of acceptable passwords that use a mix of character types.
Keep it running
Test authentication and directory systems accept all ASCII printable characters end-to-end (including reset flows), and document any disallowed characters or escaping issues.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The updated password policy document: Request the manual or digital file that outlines password rules.
Look at
Whether the policy explicitly states that all printable ASCII characters can be used.
Good evidence
Is a policy that lists examples of symbols and explains why these enhance security.
- Check 2 of 5What an auditor asks for
Ask for
System configuration reports from the IT team: Request a report or screen capture showing the settings for password management systems.
Look at
The configuration to confirm that there's an option allowing all printable ASCII characters.
Good evidence
Shows a settings page that visibly enables these options.
- Check 3 of 5What an auditor asks for
Ask for
HR for staff training records and materials: Request documents used in recent password training sessions.
Look at
How they instruct staff on creating passwords using various character types.
Good evidence
Is detailed training materials with examples showing diverse character use.
- Check 4 of 5What an auditor asks for
Ask for
To see examples of system logs regarding password changes: Request logs that show recent password creations or changes.
Look at
Whether users have successfully created passwords including a diverse range of characters.
Good evidence
Is logs demonstrating the use of symbols and numbers alongside letters.
- Check 5 of 5What an auditor asks for
Ask for
An IT audit report focusing on password security: Request an internal or external audit document that evaluates password security practices.
Look at
The section on password allowance policies and its endorsements.
Good evidence
Gives clear verification that systems allow a full range of characters.
Mappings
Closest match in ISO/IEC 27001: A.8.5, Secure authentication technologies and procedures, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.5.
ISM-2081 requires systems to accept all ASCII printable characters in passwords to avoid reducing entropy through unnecessary constraints. Annex A 8.5 requires secure authentication technologies and procedures, which typically includes configuring password mechanisms and authentication controls to meet security policy. ISM-2081 is a specific configuration requirement that fits under the broader umbrella of secure authentication design and implementation in Annex A 8.5.
ASD Essential Eight: 1 mapping
This control supports E8-RA-ML2.5.
ISM-2081 requires that all ASCII printable characters are supported for passwords, enabling stronger and more flexible password construction. E8-RA-ML2.5 requires credentials for high-risk administrative accounts to be long, unique, unpredictable, and managed, which depends on credential systems being able to represent strong secrets without restrictive character limitations. ISM-2081 strengthens E8-RA-ML2.5 by ensuring password complexity is not artificially constrained, though E8-RA-ML2.5 also covers management practices beyond character support.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.