ASD ISM 2142 Central management of application and workload credentials
What it says
Static credentials used by applications and workloads are centrally managed using a credential or secrets management solution.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure all static credentials used by applications and workloads are centrally managed in a credential or secrets management solution to enhance security and prevent leaks.
This control is about making sure that all the passwords and keys that applications and workloads use are managed from a single, secure place. It's like keeping every key in one locked key safe, where each application collects its own key when it needs it, rather than leaving spare keys hidden in random spots where anyone could find them. If this isn't done, sensitive data could be exposed if someone discovers those scattered keys.
Free. Save your status, tasks and notes.
Why it matters
If this control is missing, credentials could be scattered and insecure, making them easier for unauthorised people to access. This could lead to sensitive data being stolen or systems being compromised by outsiders who find or guess these credentials. By not centralising and securing these credentials, an organisation drastically increases its risk of a security breach.
How to implement
Choose a central secrets management tool, such as AWS Secrets Manager or HashiCorp Vault, to store all application and workload credentials securely.
Ensure this tool is set up with strong access controls to restrict who can view or modify the secrets.
Integrate this secrets management tool into your application deployment process.
Configure applications to retrieve their credentials from the tool at startup instead of storing them in code or configuration files.
For dynamic workload environments, such as Kubernetes, use an integration such as the External Secrets Operator, the Secrets Store CSI Driver or a Vault agent injector to pull credentials from your secrets management tool at runtime, ensuring that these secrets are not hardcoded into images or scripts.
Perform regular audits of the secrets within your management tool to ensure no unused or expired credentials are still active, and remove any that are no longer needed.
Run secrets-scanning tools across source code repositories, configuration files, container images and CI/CD pipelines to find any static credentials still stored outside the solution, then migrate each one into the secrets management tool and remove the hard-coded copy.
Keep it running
Regularly review and update the list of secrets to ensure they are relevant and necessary. Monitor access logs for any unusual activity that might suggest credential misuse. Keep your secrets management tool software up to date and apply patches as necessary to protect against vulnerabilities. Regularly check the integration scripts that connect applications to the solution, and keep logging enabled so that any problems applications have when retrieving credentials can be diagnosed.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Request the configuration documentation of the central secrets management tool being used.
Look at
Check that the documentation includes settings for access controls and integration details with applications.
Good evidence
Good configuration shows a well-documented setup with restricted access to credential data and clear integration points for applications.
- Check 2 of 5What an auditor asks for
Ask for
Inquire about the process for applications retrieving credentials dynamically.
Look at
Review the workflow or scripts used to connect applications to the secrets management tool.
Good evidence
A good process demonstrates credentials are fetched at runtime, reducing the risk of credentials being exposed in the source code.
- Check 3 of 5What an auditor asks for
Ask for
Ask to see audit logs from the secrets management tool.
Look at
Examine logs for instances of access or modification of secrets.
Good evidence
Good logs show each application and workload retrieving its credentials from the tool as expected, with no unauthorised access attempts or anomalies.
- Check 4 of 5What an auditor asks for
Ask for
Request the results of the most recent secrets scans across source code, configuration files, container images and CI/CD pipelines.
Look at
Check the scan scope covers all application and workload code and deployment artefacts, and review any findings of hard-coded static credentials and how they were resolved.
Good evidence
Good results show comprehensive scan coverage with no static credentials remaining outside the secrets management solution, and any past findings migrated into the solution and closed.
- Check 5 of 5What an auditor asks for
Ask for
Request an inventory of applications and workloads that use static credentials, showing which secrets management solution holds each credential.
Look at
Sample several applications and workloads from the inventory and confirm their credentials exist in the solution and are not present in local configuration.
Good evidence
A good inventory maps every application and workload credential to the central solution, and sampled systems retrieve those credentials from it rather than from local files.
Mappings
Closest match in ISO/IEC 27001: A.5.17, Management of authentication information, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.5.17.
ISM-2142 requires static credentials used by applications and workloads to be centrally managed via a credential or secrets management solution. This is a specific implementation approach that fits within ISO/IEC 27001:2022 Annex A 5.17, which requires an organisation-wide process for allocating, managing and handling authentication information. Annex A 5.17 is broader because it covers authentication information generally (including for people and multiple credential types), whereas ISM-2142 focuses on central secrets management for application/workload credentials.
ASD Essential Eight: 1 mapping
This control partially overlaps E8-RA-ML2.5.
ISM-2142 requires static credentials used by applications and workloads to be centrally managed using a credential/secrets management solution. This overlaps with E8-RA-ML2.5 because centrally managed secrets is a practical way to ensure service account (and similar non-human) credentials are managed, unique and rotated rather than hard-coded or reused. However, E8-RA-ML2.5 also covers break glass and local administrator accounts (human/admin use cases) and emphasises credential strength/uniqueness, while ISM-2142 is specifically about centralised management for application/workload static credentials.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.