ASD ISM 2142Central Management of Application and Workload Credentials
Ensure all static credentials used by applications and workloads are centrally managed in a credential or secrets management solution to enhance security and prevent leaks.
Plain language
This control is about making sure that all the passwords and keys that applications and workloads use are managed from a single, secure place. It's like keeping every key in one locked key safe, where each application collects its own key when it needs it, rather than leaving spare keys hidden in random spots where anyone could find them. If this isn't done, sensitive data could be exposed if someone discovers those scattered keys.
Framework
ASD Information Security Manual (ISM)
Control effect
Preventative
Classifications
NC, OS, P, S, TS
ISM last updated
Sept 2026
Control Stack last updated
05 Sept 2026
E8 maturity levels
N/A
Guideline
Guidelines for system accessSection
Credential managementTopic
Application and workload credentials
Official control statement
Static credentials used by applications and workloads are centrally managed using a credential or secrets management solution.
Why it matters
If this control is missing, credentials could be scattered and insecure, making them easier for unauthorised people to access. This could lead to sensitive data being stolen or systems being compromised by outsiders who find or guess these credentials. By not centralising and securing these credentials, an organisation drastically increases its risk of a security breach.
Operational notes
Regularly review and update the list of secrets to ensure they are relevant and necessary. Monitor access logs for any unusual activity that might suggest credential misuse. Keep your secrets management tool software up to date and apply patches as necessary to protect against vulnerabilities. Regularly check the integration scripts that connect applications to the solution, and keep logging enabled so that any problems applications have when retrieving credentials can be diagnosed.
Implementation tips
- Choose a central secrets management tool, such as AWS Secrets Manager or HashiCorp Vault, to store all application and workload credentials securely. Ensure this tool is set up with strong access controls to restrict who can view or modify the secrets.
- Integrate this secrets management tool into your application deployment process. Configure applications to retrieve their credentials from the tool at startup instead of storing them in code or configuration files.
- For dynamic workload environments, such as Kubernetes, use an integration such as the External Secrets Operator, the Secrets Store CSI Driver or a Vault agent injector to pull credentials from your secrets management tool at runtime, ensuring that these secrets are not hardcoded into images or scripts.
- Perform regular audits of the secrets within your management tool to ensure no unused or expired credentials are still active, and remove any that are no longer needed.
- Run secrets-scanning tools across source code repositories, configuration files, container images and CI/CD pipelines to find any static credentials still stored outside the solution, then migrate each one into the secrets management tool and remove the hard-coded copy.
Audit / evidence tips
- AskRequest the configuration documentation of the central secrets management tool being used.Look atCheck that the documentation includes settings for access controls and integration details with applications.GoodGood configuration shows a well-documented setup with restricted access to credential data and clear integration points for applications.
- AskInquire about the process for applications retrieving credentials dynamically.Look atReview the workflow or scripts used to connect applications to the secrets management tool.GoodA good process demonstrates credentials are fetched at runtime, reducing the risk of credentials being exposed in the source code.
- AskAsk to see audit logs from the secrets management tool.Look atExamine logs for instances of access or modification of secrets.GoodGood logs show each application and workload retrieving its credentials from the tool as expected, with no unauthorised access attempts or anomalies.
- AskRequest the results of the most recent secrets scans across source code, configuration files, container images and CI/CD pipelines.Look atCheck the scan scope covers all application and workload code and deployment artefacts, and review any findings of hard-coded static credentials and how they were resolved.GoodGood results show comprehensive scan coverage with no static credentials remaining outside the secrets management solution, and any past findings migrated into the solution and closed.
- AskRequest an inventory of applications and workloads that use static credentials, showing which secrets management solution holds each credential.Look atSample several applications and workloads from the inventory and confirm their credentials exist in the solution and are not present in local configuration.GoodA good inventory maps every application and workload credential to the central solution, and sampled systems retrieve those credentials from it rather than from local files.
Cross-framework mappings
How ISM-2142 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
layersPartially meets(1)expand_less | ||
| Annex A 5.17 | ISM-2142 requires static credentials used by applications and workloads to be centrally managed via a credential or secrets management so... | |
E8
| Control | Notes | Details |
|---|---|---|
sync_altPartially overlaps(1)expand_less | ||
| E8-RA-ML2.5 | ISM-2142 requires static credentials used by applications and workloads to be centrally managed using a credential/secrets management sol... | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in System access
See all Guidelines for system access controls, or browse the full ASD ISM library.