Guidelines for system access
123 controls in 2 sections in this part of the ASD ISM. Each control links to plain-English guidance, audit tips and cross-framework mappings.
123 controls
No controls on this page match.
Credential management
43 controls- ISM-0418Keep physical credentials separate from systemsStore physical credentials away from systems except when logging in.NCOSPSTS
- ISM-0421Require minimum 15-character passwords for securityPasswords for sensitive systems must have at least 15 characters to enhance security.NCOSP
- ISM-0422Ensuring strong passwords for TOP SECRET systemsPasswords on TOP SECRET systems should be at least 20 characters to ensure strong security.TS
- ISM-1227Randomly generate user account credentialsUser account passwords must be created randomly to enhance security.NCOSPSTS
- ISM-1402Protecting stored credentials with security measuresStore credentials securely using a password manager, hardware module, or by enhancing them with techniques before saving.NCOSPSTS
- ISM-1557Ensure strong passwords for SECRET systemsPasswords for SECRET systems must be at least 17 characters long to enhance security.S
- ISM-1558Ensure secure construction of passwordsPasswords must not use predictable sequences, like quotes or sentences, and must meet minimum word count rules for security levels.NCOSPSTS
- ISM-1559Minimum password length for secure systemsPasswords for secure systems should have at least 6 characters to enhance security.NCOSP
- ISM-1560Ensure strong passwords for SECRET system authenticationPasswords for SECRET systems using multi-factor authentication must be at least 8 characters.S
- ISM-1561Ensure strong passwords for TOP SECRET systemsTOP SECRET systems must use passwords of at least 10 characters for added security.TS
- ISM-1590Changing user account credentials after compromise, exposure or shared membership changeReset user account passwords and other credentials as soon as they are compromised, found in the clear on systems or networks, or when someone joins or leaves a shared account.NCOSPSTS
- ISM-1593Verify user identity before issuing, resetting, disabling or enrolling credentialsBefore anyone gets new credentials, a reset, a temporary disable, or an enrolment, they must first prove they are who they claim to be.NCOSPSTS
- ISM-1594Delivering user credentials via secure channel or split partsHand new or reset credentials to people over a secure channel, or split them in two and give one half to the user and the other half to their supervisor.NCOSPSTS
- ISM-1595Credentials issued to human users are changed on first useAny credential handed to a person (an initial password, passphrase or PIN) is treated as temporary and must be replaced by the user the first time they use it.NCOSPSTS
- ISM-1596Avoid reusing credentials across systemsUsers should not use the same passwords on different systems for better security.NCOSPSTS
- ISM-1597Ensuring credential input obscurityPasswords and personal credentials are hidden when entered in systems to enhance security.NCOSPSTS
- ISM-1619Configure service accounts as managed service accountsEnsure service accounts are created as Managed Service Accounts for improved security.NCOSPSTS
- ISM-1685Strengthening passwords for critical accountsEnsure passwords for high-risk accounts are strong, unique, and properly managed.NCOSPSTS
- ISM-1686Enable Credential Guard for credential protectionCredential Guard is activated to better protect user credentials from unauthorised access.NCOSPSTS
- ISM-1749Limit cached credentials to single logonUsers' credentials are stored only for their last login to enhance security.NCOSPSTS
- ISM-1795Set 30-character minimum for key administrator passwordsEnsure key system accounts use passwords that are at least 30 characters long to enhance security.NCOSPSTS
- ISM-1847Double KRBTGT password reset after compromise or six monthsReset the Active Directory KRBTGT account password twice, waiting for full domain controller replication between resets, after any known or suspected domain compromise and at least every six months.NCOSPSTS
- ISM-1861Enable Local Security Authority protectionEnsure the system has measures to secure login details against unauthorised access.NCOSPSTS
- ISM-1875Monthly system scans to detect credentials stored in the clearRun a scan across your systems at least once a month to find any passwords, keys or other credentials sitting unprotected in plain text, then deal with what is found.NCOSPSTS
- ISM-1897Enable Remote Credential Guard for credential protectionActivating Remote Credential Guard helps prevent unauthorised access to security credentials.NCOSPSTS
- ISM-1953Ensure strong management of admin account credentialsMake sure admin account passwords in each domain are long, unique, and securely managed.NCOSPSTS
- ISM-1954Enforce random credentials for administrator accountsEnsure admin and service account passwords are randomly generated to improve security.NCOSPSTS
- ISM-1955Regularly change compromised credentialsChange computer account passwords every 30 days or if they're compromised or suspected to be.NCOSPSTS
- ISM-1956Regularly update AD FS certificates to prevent risksAD FS certificates must be updated twice quickly if compromised or not updated within a year to enhance security.NCOSPSTS
- ISM-1957Hardware security module protection for Microsoft AD CS private keysEvery Microsoft AD CS certification authority, root and subordinate alike, keeps its private key inside a hardware security module rather than on the Windows server itself.NCOSPSTS
- ISM-1980Avoid using credential hints in systemsSystems should not use hints to reveal or guess passwords.NCOSPSTS
- ISM-2078Ensure passwords are not common or compromisedMake sure passwords aren't from known compromised or common password lists to enhance security.NCOSPSTS
- ISM-2079Ensure password length is at least 64 charactersPasswords must allow a maximum length of at least 64 characters for increased security.NCOSPSTS
- ISM-2080No password complexity requirements enforcedPasswords do not need to follow strict complexity rules.NCOSPSTS
- ISM-2081Enforce use of all ASCII characters in passwordsAllow any printable character to be used in passwords for increased complexity.NCOSPSTS
- ISM-2141Prefer short-lived dynamically issued credentials for applications and workloadsApplications and workloads should obtain temporary credentials on demand rather than relying on fixed keys or passwords that stay valid indefinitely.NCOSPSTS
- ISM-2142Central management of application and workload credentialsEnsure all static credentials used by applications and workloads are centrally managed in a credential or secrets management solution to enhance security and prevent leaks.NCOSPSTS
- ISM-2143Unique per-application credentials not shared across environmentsEvery application and workload gets its own credentials, never reused by another application or workload, and never carried between development, testing, staging and production.NCOSPSTS
- ISM-2144Change application static credentials found compromised or exposed in clearRotate the fixed passwords, keys and tokens that applications and workloads use whenever they are compromised, suspected compromised, or found stored or transmitted unencrypted.NCOSPSTS
- ISM-2145Revoke user account credentials when no longer requiredPasswords, tokens, keys and other credentials tied to user accounts are actively withdrawn as soon as the need for them ends, so nothing usable is left behind.NCOSPSTS
- ISM-2146Revoking static application and workload credentials when no longer requiredStatic credentials that applications and workloads use (API keys, service account passwords, tokens) are actively revoked as soon as the need for them ends.NCOSPSTS
- ISM-2147Cryptographically bind tokens and session cookies to issuing deviceStolen logins should be useless elsewhere: tokens, session cookies and refresh tokens only work on the device that originally received them.NCOSPSTS
- ISM-2148Revoke sessions and tokens on reset, compromise, non-compliance or risky sign-inKill existing logins, refresh tokens and similar artefacts whenever a credential is reset, compromised, a device falls out of compliance, or a risky sign-in is spotted.NCOSPSTS
Identity and access management
80 controls- ISM-0078Australian supervision of AUSTEO/AGAO data systemsOnly Australian nationals should control systems handling sensitive Australian data.STS
- ISM-0405Validation for unprivileged system access requestsRequests for basic system access are checked when they are first made.NCOSPSTS
- ISM-0407Maintaining a secure lifetime access record for each human userKeep a tamper-resistant record, for as long as each system and its resources exist, of who was given access, by whom, at what level, when it was reviewed or changed, and when it was removed.NCOSPSTS
- ISM-0408Logon banner for security responsibilitiesA logon banner reminds users of their security duties before accessing a system.NCOSPSTS
- ISM-0409Restricting foreign national access to AUSTEO and REL systemsKeep foreign nationals, including secondees, off systems holding AUSTEO or REL data unless proven controls stop them from reaching that data.STS
- ISM-0411Restricting foreign national access to systems handling AGAO dataKeeps AGAO data away from foreign nationals (other than seconded ones) by denying them system access, or by proving controls stop them reaching that data.STS
- ISM-0414Uniquely identifying every user granted system accessEvery person given access to a system or its resources gets their own distinct identity, so actions can always be traced back to one accountable individual.NCOSPSTS
- ISM-0415Strictly controlling shared accounts and identifying their usersShared accounts are allowed only under tight control, and every action taken through one must be traceable to a named person.NCOSPSTS
- ISM-0417Use passwords when multi-factor authentication isn't supportedIf systems can't use multi-factor authentication, they should use passwords for single-factor authentication.NCOSPSTS
- ISM-0420Identify nationality of foreign personnel in systemEnsure foreign nationals using the system are identified by their nationality for sensitive data security.STS
- ISM-0428Session lock timing, content blocking and full re-authentication for servicesServices must lock idle or long-running sessions, hide everything on screen, demand all authentication factors to unlock, and stop users from switching the lock off.NCOSPSTS
- ISM-0430Same-day removal or suspension of access no longer requiredWhen a user's need for access ends, their access to systems and resources is cut off (removed or suspended) that same day, not days or weeks later.NCOSPSTS
- ISM-0432Document system access requirements in security plansSystem access rules must be documented in each system's security plan to ensure proper access management.NCOSPSTS
- ISM-0434Ensure personnel employment screening and security clearanceStaff need job screening and security clearance for system access.NCOSPSTS
- ISM-0435Pre-access briefings for system resourcesStaff must be briefed before accessing system resources.NCOSPSTS
- ISM-0441Restricting temporary system access to data required for dutiesAnyone given short-term access to a system must be technically limited to the specific data their task needs, rather than inheriting broad access for convenience.NCOSPSTS
- ISM-0443Restrict temporary access to secure systemsTemporary access is not allowed for systems handling highly sensitive information.STS
- ISM-0445Dedicated privileged accounts used solely for privileged dutiesEach person who needs privileged access gets a separate admin account, kept apart from their everyday account and used only when the task genuinely needs elevated rights.NCOSPSTS
- ISM-0446Restrict privileged access for foreign nationalsForeign nationals can't access Australian systems with sensitive data privileges.STS
- ISM-0447Restrict privileged access for foreign nationalsForeign nationals can't have privileged access to systems handling AGAO data except if seconded.STS
- ISM-0853Terminate interactive user sessions and restart workstations at least dailyEvery interactive user session on a workstation is ended, and the workstation itself is rebooted, at least once every day so nothing runs indefinitely.NCOSPSTS
- ISM-0854Access restrictions for AUSTEO and AGAO dataAUSTEO and AGAO data is only accessible via government-controlled systems within authorised facilities.STS
- ISM-0974Multi-factor authentication for unprivileged human users of systemsEvery ordinary (non-admin) staff account must prove identity with two or more factors, not just a password, whenever a person signs in to a system.NCOSPSTS
- ISM-1055Disable insecure LAN manager authenticationSystems must disable outdated LAN Manager and NT LAN Manager authentication to enhance security.NCOSPSTS
- ISM-1173Multi-factor authentication for privileged human users of systemsEvery person who holds privileged access to a system must prove who they are with more than a password before that access is granted.NCOSPSTS
- ISM-1175Restrict privileged users from internet accessPrivileged accounts can't access the internet or web services unless explicitly allowed.NCOSPSTS
- ISM-1263Enforce unique accounts for server administrationAdministrators must use unique accounts to manage each server application.NCOSPSTS
- ISM-1401Multi-factor authentication combines possession with knowledge or inherenceSets the two combinations of factors that count as multi-factor authentication: a possessed item plus a secret, or a possessed item unlocked by a secret or a biometric.NCOSPSTS
- ISM-1403Lock accounts after five failed logon attemptsUser accounts must lock after no more than five failed login attempts, with the lockout lasting indefinitely or until it clears automatically, except for emergency break glass accounts.NCOSPSTS
- ISM-1404Disabling inactive user access after 45 daysIf a user doesn't use their system access for 45 days, it's disabled to keep the system secure.NCOSPSTS
- ISM-1504Multi-factor authentication for human users of sensitive data online servicesEvery person logging in to an organisation's own online services that handle its sensitive data must prove who they are with more than a password.NCOSPSTS
- ISM-1505Multi-factor authentication for human users of data repositoriesPeople who log in to databases, file shares, document stores and similar data repositories must prove who they are with a second factor, not a password alone.NCOSPSTS
- ISM-1507Ensure requests for privileged access are verifiedRequests for special system access are checked before approval to prevent unauthorised use.NCOSPSTS
- ISM-1508Restricting privileged access to what duties requirePrivileged accounts should carry only the elevated rights each person's role actually needs on the specific systems and resources they work with, and nothing more.NCOSPSTS
- ISM-1509Log privileged access events centrally for monitoringKeep records of high-level system access in one place to monitor and respond to potential issues.NCOSPSTS
- ISM-1546Ensure user authentication before system accessVerify user identities before they can access any system.NCOSPSTS
- ISM-1566Central logging of unprivileged system accessSystem logs keep track of unprivileged user actions to monitor access and security.NCOSPSTS
- ISM-1583Ensure contractors are identified as usersEnsure contractors are labelled distinctively from other personnel in systems.NCOSPSTS
- ISM-1591Remove or suspend access when users are detected acting maliciouslyWhen a user is caught doing something malicious, their access to systems and the resources within them is cut off or frozen without unnecessary delay, so the harm cannot continue.NCOSPSTS
- ISM-1603Disabling vulnerable authentication methodsTurn off login methods that can be tricked into accepting false entries.NCOSPSTS
- ISM-1610Document and test emergency system access proceduresEnsure emergency access to IT systems is documented and tested during major IT changes.NCOSPSTS
- ISM-1611Use break glass accounts only in emergenciesBreak glass accounts should be used only if normal login methods fail.NCOSPSTS
- ISM-1612Restricted use of break glass accounts for emergenciesUse special accounts only for approved emergency activities to maintain system security.NCOSPSTS
- ISM-1613Central logging of break glass account usageLogging is used to track and monitor the use of emergency access accounts.NCOSPSTS
- ISM-1614Manage emergency account access changesChange break glass account passwords after emergency access.NCOSPSTS
- ISM-1615Testing break glass accounts post credential changeEnsure emergency accounts work properly after changing their passwords.NCOSPSTS
- ISM-1647Disable privileged access after 12 monthsPrivileged system access is disabled if not revalidated within a year.NCOSPSTS
- ISM-1648Disabling inactive privileged access to systemsAccess with special privileges is disabled if not used for 45 days to enhance system security.NCOSPSTS
- ISM-1649Implement just-in-time administration for system accessUse just-in-time methods to manage who can access system resources, ensuring enhanced security.NCOSPSTS
- ISM-1650Log management of privileged user activitiesKeep track of changes to privileged user accounts by logging them in one central place.NCOSPSTS
- ISM-1679Multi-factor authentication for third-party services handling sensitive dataStaff logging in to external online services that handle your sensitive data must prove who they are with more than a password, so a stolen credential alone cannot open the account.NCOSPSTS
- ISM-1680Multi-factor authentication for human users of third-party services holding non-sensitive dataTurn on MFA for every staff login to third-party online services that hold your non-sensitive data, wherever the service offers it.NCOSPSTS
- ISM-1681Mandating multi-factor authentication for customer servicesCustomers must use multi-factor authentication when accessing sensitive online services.NCOSPSTS
- ISM-1682Phishing-resistant multi-factor authentication for human users of systemsEvery MFA method that people use to sign in to systems must be one that a phishing site or fake login page cannot capture and replay.NCOSPSTS
- ISM-1683Central logging of multi-factor authentication eventsMulti-factor authentication attempts, whether they succeed or not, are logged together in a central system.NCOSPSTS
- ISM-1852Limit unprivileged access to what duties requireOrdinary (non-administrative) users get access only to the systems and resources their job actually needs, so that stray or excess access cannot be misused.NCOSPSTS
- ISM-1864Develop and enforce a system usage policyCreate and regularly update a policy that dictates how systems should be used within the organisation.NCOSPSTS
- ISM-1865Compliance with system usage policies for accessEmployees must agree to follow system rules before they can access it.NCOSPSTS
- ISM-1872Phishing-resistant multi-factor authentication for human users of online servicesWhen people sign in to online services, the second factor must be one a fake login page cannot capture or replay, so a tricked user still cannot be impersonated.NCOSPSTS
- ISM-1873Enhance security with phishing-resistant MFAOnline services should use multi-factor authentication that cannot be easily tricked by phishing.NCOSPSTS
- ISM-1874Phishing-resistant multi-factor authentication for customersOnline services use multi-step security to prevent phishing attacks during customer login.NCOSPSTS
- ISM-1883Limit authorised privileged account online service access to dutiesWhere a privileged account has been explicitly allowed to reach online services, that access is cut back to only the specific services the person genuinely needs for their role.NCOSPSTS
- ISM-1892Multi-factor authentication for organisation users of online customer servicesStaff, administrators and support agents who sign in to the organisation's own online customer services handling sensitive customer data must use multi-factor authentication, not a password alone.NCOSPSTS
- ISM-1893Multi-factor authentication for third-party services holding sensitive customer dataStaff logging in to outside online services that hold your sensitive customer data must prove who they are with more than a password.NCOSPSTS
- ISM-1894Phishing-resistant multi-factor authentication for human users of data repositoriesWhere people log in to data repositories with multi-factor authentication, the second factor must be one that a phishing site or fake login page cannot capture and replay.NCOSPSTS
- ISM-1895Log single-factor authentication eventsKeep track of successful and unsuccessful single-factor login attempts.NCOSPSTS
- ISM-1919Disable authentication protocols that cannot support multi-factor authenticationWhere MFA protects logins to online services, every legacy or alternative sign-in protocol that cannot carry MFA is switched off so attackers cannot sidestep it.NCOSPSTS
- ISM-1920Blocking MFA self-enrolment from untrustworthy devicesUsers of sensitive-data systems cannot register their own MFA method from a device the organisation has no reason to trust, closing a common account-takeover route.NCOSPSTS
- ISM-2011Disabling weaker MFA options when phishing-resistant MFA is usedOnce a person signs in with phishing-resistant MFA, their account must not keep any weaker MFA method switched on as a fallback that an attacker could target instead.NCOSPSTS
- ISM-2012Enforced screen lock with full re-authentication after inactivitySystems lock within 15 minutes of inactivity (or on demand), hide everything on screen, stay awake until locked, need all authentication factors to unlock, and cannot be switched off by users.NCOSPSTS
- ISM-2076Eliminating security questions for authenticationAuthentication should not use security questions as they can be easily compromised.NCOSPSTS
- ISM-2077Avoid email for out-of-band authenticationDo not use email for secondary authentication steps to increase security.NCOSPSTS
- ISM-2133Assign each AI agent a unique identity distinct from personnel accountsEvery AI agent gets its own identity. It must never run under a person's user account or share an identity with another AI agent, so its actions can be told apart from everyone else's.NCOSPSTS
- ISM-2134Develop, maintain and regularly verify an AI agent registerKeep a single, current record of every AI agent operating in the organisation, and check it regularly against reality so no agent runs unknown or unaccounted for.NCOSPSTS
- ISM-2135Recording identifier, owner, identities, credentials and access for each AI agentEvery AI agent gets a register entry that names it, says who owns it and why it exists, and lists the identities, accounts, credentials, tools, permissions and data it can use.NCOSPSTS
- ISM-2136Enforcing risk-based access decisions informed by contextual signalsAccess to systems and their resources is granted, stepped up or denied according to the risk of each request, judged from signals such as the user, device, location and behaviour.NCOSPSTS
- ISM-2137Block user OAuth consent, reserve it for authorised administratorsOrdinary users cannot approve third-party OAuth apps to access organisational data or accounts. Only an authorised administrator can grant that consent, after review.NCOSPSTS
- ISM-2138Six-monthly review of OAuth application consents and granted permissionsCheck every OAuth app consent and its permissions at least twice a year, then revoke apps nobody uses and permissions that go beyond what the app needs.NCOSPSTS
- ISM-2139Central logging of third-party OAuth consent, token issuance and useSend every third-party OAuth consent grant, token issuance and token use event from your identity platform to one central log store so app access can be traced and investigated.NCOSPSTS
- ISM-2140Disable OAuth device code flow unless required and restrict its useTurn off the OAuth device code sign-in flow by default, and where a genuine need exists, allow it only for approved user accounts signing in from organisation-managed devices.NCOSPSTS
Back to the full Australian Government Information Security Manual control list, or browse the complete control library.