PRO-13 Identity, credential and access management
6 actions under this Protect principle in ASD Essentials for enterprise IT. Each action links to plain-English guidance, audit tips and cross-framework mappings.
ASD principle statement
Robust and secure identity, credential and access management is used to establish, maintain and control access to systems (infrastructure, operating systems, applications and data) and to support effective detection of identity and credential misuse.
Quoted as published. Everything else on this page is written by Control Stack.
The six actions
- IT.PRO-13.1Regularly Find and Disable or Remove Default and Unused Accounts
Finds and switches off or deletes built-in and unused accounts regularly, keeping any only if documented, justified, locked down and monitored.
Domains:All six technical domains (Boundary services, Identity services, Critical processes and services, Privileged environments, Business systems, User devices) - IT.PRO-13.2Store Keys, Secrets and Tokens in Approved, Access-Controlled Repositories with MFA
Keeps passwords, keys, tokens and other secrets in an approved secure store, with tight access controls and multi-factor sign-in.
Domains:Boundary servicesIdentity servicesCritical processes and servicesPrivileged environmentsBusiness systems - IT.PRO-13.3Run Regular Secret Scanning and Rotate or Revoke Exposed Credentials
Scans code, settings files, shared drives and collaboration tools regularly for exposed passwords, keys and other secrets, then changes or cancels them.
Domains:Visibility and response - IT.PRO-13.4Enforce Phishing-Resistant MFA for All User Authentication, Including from Untrusted Locations
Requires users to sign in to systems with multi-factor authentication that fake sites cannot trick, including from untrusted, external or high-risk locations.
Domains:All six technical domains (Boundary services, Identity services, Critical processes and services, Privileged environments, Business systems, User devices) - IT.PRO-13.5Disable Legacy Authentication Protocols and Restrict, Monitor and Decommission Exceptions
Switches off older, weaker sign-in methods, and puts limits, monitoring, extra safeguards and a removal date on any that must stay.
Domains:All six technical domains (Boundary services, Identity services, Critical processes and services, Privileged environments, Business systems, User devices) - IT.PRO-13.6Enforce Unique Credentials per System and Account, Especially in High-Privilege Contexts
Gives every account its own password or key on each system, never shared or reused, especially for accounts with admin rights.
Domains:All six technical domains (Boundary services, Identity services, Critical processes and services, Privileged environments, Business systems, User devices)
Back to the full Essentials for enterprise IT action list, or browse the complete control library.