search account_circle

policyASD ISM

Guidelines for system access

123 controls in this part of the ASD ISM. Each control links to plain-English guidance, audit tips and cross-framework mappings.

Credential management

Keep Physical Credentials Separate from Systems

Store physical credentials away from systems except when logging in.

Require Minimum 15-Character Passwords for Security

Passwords for sensitive systems must have at least 15 characters to enhance security.

Ensuring Strong Passwords for TOP SECRET Systems

Passwords on TOP SECRET systems should be at least 20 characters to ensure strong security.

Randomly Generate User Account Credentials

User account passwords must be created randomly to enhance security.

Protecting Stored Credentials with Security Measures

Store credentials securely using a password manager, hardware module, or by enhancing them with tech

Ensure Strong Passwords for SECRET Systems

Passwords for SECRET systems must be at least 17 characters long to enhance security.

Ensure Secure Construction of Passwords

Passwords must not use predictable sequences, like quotes or sentences, and must meet minimum word c

Minimum Password Length for Secure Systems

Passwords for secure systems should have at least 6 characters to enhance security.

Ensure Strong Passwords for SECRET System Authentication

Passwords for SECRET systems using multi-factor authentication must be at least 8 characters.

Ensure Strong Passwords for TOP SECRET Systems

TOP SECRET systems must use passwords of at least 10 characters for added security.

Changing User Account Credentials After Compromise, Exposure or Shared Membership Change

Reset user account passwords and other credentials as soon as they are compromised, found in the cle

Verify User Identity Before Issuing, Resetting, Disabling or Enrolling Credentials

Before anyone gets new credentials, a reset, a temporary disable, or an enrolment, they must first p

Delivering User Credentials via Secure Channel or Split Parts

Hand new or reset credentials to people over a secure channel, or split them in two and give one hal

Credentials Issued to Human Users Are Changed on First Use

Any credential handed to a person (an initial password, passphrase or PIN) is treated as temporary a

Avoid Reusing Credentials Across Systems

Users should not use the same passwords on different systems for better security.

Ensuring Credential Input Obscurity

Passwords and personal credentials are hidden when entered in systems to enhance security.

Configure Service Accounts as Managed Service Accounts

Ensure service accounts are created as Managed Service Accounts for improved security.

Strengthening Passwords for Critical Accounts

Ensure passwords for high-risk accounts are strong, unique, and properly managed.

Enable Credential Guard for Credential Protection

Credential Guard is activated to better protect user credentials from unauthorised access.

Limit Cached Credentials to Single Logon

Users' credentials are stored only for their last login to enhance security.

Set 30-Character Minimum for Key Administrator Passwords

Ensure key system accounts use passwords that are at least 30 characters long to enhance security.

Double KRBTGT Password Reset After Compromise or Six Months

Reset the Active Directory KRBTGT account password twice, waiting for full domain controller replica

Enable Local Security Authority Protection

Ensure the system has measures to secure login details against unauthorised access.

Monthly System Scans to Detect Credentials Stored in the Clear

Run a scan across your systems at least once a month to find any passwords, keys or other credential

Enable Remote Credential Guard for Credential Protection

Activating Remote Credential Guard helps prevent unauthorised access to security credentials.

Ensure Strong Management of Admin Account Credentials

Make sure admin account passwords in each domain are long, unique, and securely managed.

Enforce Random Credentials for Administrator Accounts

Ensure admin and service account passwords are randomly generated to improve security.

Regularly Change Compromised Credentials

Change computer account passwords every 30 days or if they're compromised or suspected to be.

Regularly Update AD FS Certificates to Prevent Risks

AD FS certificates must be updated twice quickly if compromised or not updated within a year to enha

Hardware Security Module Protection for Microsoft AD CS Private Keys

Every Microsoft AD CS certification authority, root and subordinate alike, keeps its private key ins

Avoid Using Credential Hints in Systems

Systems should not use hints to reveal or guess passwords.

Ensure Passwords Are Not Common or Compromised

Make sure passwords aren't from known compromised or common password lists to enhance security.

Ensure Password Length is at Least 64 Characters

Passwords must allow a maximum length of at least 64 characters for increased security.

No Password Complexity Requirements Enforced

Passwords do not need to follow strict complexity rules.

Enforce Use of All ASCII Characters in Passwords

Allow any printable character to be used in passwords for increased complexity.

Prefer Short-Lived Dynamically Issued Credentials for Applications and Workloads

Applications and workloads should obtain temporary credentials on demand rather than relying on fixe

Central Management of Application and Workload Credentials

Ensure all static credentials used by applications and workloads are centrally managed in a credenti

Unique Per-Application Credentials Not Shared Across Environments

Every application and workload gets its own credentials, never reused by another application or work

Change Application Static Credentials Found Compromised or Exposed in Clear

Rotate the fixed passwords, keys and tokens that applications and workloads use whenever they are co

Revoke User Account Credentials When No Longer Required

Passwords, tokens, keys and other credentials tied to user accounts are actively withdrawn as soon a

Revoking Static Application and Workload Credentials When No Longer Required

Static credentials that applications and workloads use (API keys, service account passwords, tokens)

Cryptographically Bind Tokens and Session Cookies to Issuing Device

Stolen logins should be useless elsewhere: tokens, session cookies and refresh tokens only work on t

Revoke Sessions and Tokens on Reset, Compromise, Non-Compliance or Risky Sign-In

Kill existing logins, refresh tokens and similar artefacts whenever a credential is reset, compromis

Identity and access management

Australian Supervision of AUSTEO/AGAO Data Systems

Only Australian nationals should control systems handling sensitive Australian data.

Validation for Unprivileged System Access Requests

Requests for basic system access are checked when they are first made.

Maintaining a Secure Lifetime Access Record for Each Human User

Keep a tamper-resistant record, for as long as each system and its resources exist, of who was given

Logon Banner for Security Responsibilities

A logon banner reminds users of their security duties before accessing a system.

Restricting Foreign National Access to AUSTEO and REL Systems

Keep foreign nationals, including secondees, off systems holding AUSTEO or REL data unless proven co

Restricting Foreign National Access to Systems Handling AGAO Data

Keeps AGAO data away from foreign nationals (other than seconded ones) by denying them system access

Uniquely Identifying Every User Granted System Access

Every person given access to a system or its resources gets their own distinct identity, so actions

Strictly Controlling Shared Accounts and Identifying Their Users

Shared accounts are allowed only under tight control, and every action taken through one must be tra

Use Passwords When Multi-Factor Authentication Isn't Supported

If systems can't use multi-factor authentication, they should use passwords for single-factor authen

Identify Nationality of Foreign Personnel in System

Ensure foreign nationals using the system are identified by their nationality for sensitive data sec

Session Lock Timing, Content Blocking and Full Re-Authentication for Services

Services must lock idle or long-running sessions, hide everything on screen, demand all authenticati

Same-Day Removal or Suspension of Access No Longer Required

When a user's need for access ends, their access to systems and resources is cut off (removed or sus

Document System Access Requirements in Security Plans

System access rules must be documented in each system's security plan to ensure proper access manage

Ensure Personnel Employment Screening and Security Clearance

Staff need job screening and security clearance for system access.

Pre-Access Briefings for System Resources

Staff must be briefed before accessing system resources.

Restricting Temporary System Access to Data Required for Duties

Anyone given short-term access to a system must be technically limited to the specific data their ta

Restrict Temporary Access to Secure Systems

Temporary access is not allowed for systems handling highly sensitive information.

Dedicated Privileged Accounts Used Solely for Privileged Duties

Each person who needs privileged access gets a separate admin account, kept apart from their everyda

Restrict Privileged Access for Foreign Nationals

Foreign nationals can't access Australian systems with sensitive data privileges.

Restrict Privileged Access for Foreign Nationals

Foreign nationals can't have privileged access to systems handling AGAO data except if seconded.

Terminate Interactive User Sessions and Restart Workstations at Least Daily

Every interactive user session on a workstation is ended, and the workstation itself is rebooted, at

Access Restrictions for AUSTEO and AGAO Data

AUSTEO and AGAO data is only accessible via government-controlled systems within authorised faciliti

Multi-Factor Authentication for Unprivileged Human Users of Systems

Every ordinary (non-admin) staff account must prove identity with two or more factors, not just a pa

Disable Insecure LAN Manager Authentication

Systems must disable outdated LAN Manager and NT LAN Manager authentication to enhance security.

Multi-Factor Authentication for Privileged Human Users of Systems

Every person who holds privileged access to a system must prove who they are with more than a passwo

Restrict Privileged Users from Internet Access

Privileged accounts can't access the internet or web services unless explicitly allowed.

Enforce Unique Accounts for Server Administration

Administrators must use unique accounts to manage each server application.

Multi-Factor Authentication Combines Possession With Knowledge or Inherence

Sets the two combinations of factors that count as multi-factor authentication: a possessed item plu

Lock Accounts After Five Failed Logon Attempts

User accounts must lock after no more than five failed login attempts, with the lockout lasting inde

Disabling Inactive User Access After 45 Days

If a user doesn't use their system access for 45 days, it's disabled to keep the system secure.

Multi-Factor Authentication for Human Users of Sensitive Data Online Services

Every person logging in to an organisation's own online services that handle its sensitive data must

Multi-factor Authentication for Human Users of Data Repositories

People who log in to databases, file shares, document stores and similar data repositories must prov

Ensure Requests for Privileged Access are Verified

Requests for special system access are checked before approval to prevent unauthorised use.

Restricting Privileged Access to What Duties Require

Privileged accounts should carry only the elevated rights each person's role actually needs on the s

Log Privileged Access Events Centrally for Monitoring

Keep records of high-level system access in one place to monitor and respond to potential issues.

Ensure User Authentication Before System Access

Verify user identities before they can access any system.

Central Logging of Unprivileged System Access

System logs keep track of unprivileged user actions to monitor access and security.

Ensure Contractors are Identified as Users

Ensure contractors are labelled distinctively from other personnel in systems.

Remove or Suspend Access When Users Are Detected Acting Maliciously

When a user is caught doing something malicious, their access to systems and the resources within th

Disabling Vulnerable Authentication Methods

Turn off login methods that can be tricked into accepting false entries.

Document and Test Emergency System Access Procedures

Ensure emergency access to IT systems is documented and tested during major IT changes.

Use Break Glass Accounts Only in Emergencies

Break glass accounts should be used only if normal login methods fail.

Restricted Use of Break Glass Accounts for Emergencies

Use special accounts only for approved emergency activities to maintain system security.

Central Logging of Break Glass Account Usage

Logging is used to track and monitor the use of emergency access accounts.

Manage Emergency Account Access Changes

Change break glass account passwords after emergency access.

Testing Break Glass Accounts Post Credential Change

Ensure emergency accounts work properly after changing their passwords.

Disable Privileged Access After 12 Months

Privileged system access is disabled if not revalidated within a year.

Disabling Inactive Privileged Access to Systems

Access with special privileges is disabled if not used for 45 days to enhance system security.

Implement Just-in-Time Administration for System Access

Use just-in-time methods to manage who can access system resources, ensuring enhanced security.

Log Management of Privileged User Activities

Keep track of changes to privileged user accounts by logging them in one central place.

Multi-factor Authentication for Third-party Services Handling Sensitive Data

Staff logging in to external online services that handle your sensitive data must prove who they are

Multi-Factor Authentication for Human Users of Third-Party Services Holding Non-Sensitive Data

Turn on MFA for every staff login to third-party online services that hold your non-sensitive data,

Mandating Multi-Factor Authentication for Customer Services

Customers must use multi-factor authentication when accessing sensitive online services.

Phishing-resistant multi-factor authentication for human users of systems

Every MFA method that people use to sign in to systems must be one that a phishing site or fake logi

Central Logging of Multi-factor Authentication Events

Multi-factor authentication attempts, whether they succeed or not, are logged together in a central

Limit Unprivileged Access to What Duties Require

Ordinary (non-administrative) users get access only to the systems and resources their job actually

Develop and Enforce a System Usage Policy

Create and regularly update a policy that dictates how systems should be used within the organisatio

Compliance with System Usage Policies for Access

Employees must agree to follow system rules before they can access it.

Phishing-Resistant Multi-Factor Authentication for Human Users of Online Services

When people sign in to online services, the second factor must be one a fake login page cannot captu

Enhance Security with Phishing-Resistant MFA

Online services should use multi-factor authentication that cannot be easily tricked by phishing.

Phishing-Resistant Multi-Factor Authentication for Customers

Online services use multi-step security to prevent phishing attacks during customer login.

Limit Authorised Privileged Account Online Service Access to Duties

Where a privileged account has been explicitly allowed to reach online services, that access is cut

Multi-Factor Authentication for Organisation Users of Online Customer Services

Staff, administrators and support agents who sign in to the organisation's own online customer servi

Multi-Factor Authentication for Third-Party Services Holding Sensitive Customer Data

Staff logging in to outside online services that hold your sensitive customer data must prove who th

Phishing-Resistant Multi-Factor Authentication for Human Users of Data Repositories

Where people log in to data repositories with multi-factor authentication, the second factor must be

Log Single-factor Authentication Events

Keep track of successful and unsuccessful single-factor login attempts.

Disable Authentication Protocols That Cannot Support Multi-Factor Authentication

Where MFA protects logins to online services, every legacy or alternative sign-in protocol that cann

Blocking MFA Self-Enrolment From Untrustworthy Devices

Users of sensitive-data systems cannot register their own MFA method from a device the organisation

Disabling Weaker MFA Options When Phishing-Resistant MFA Is Used

Once a person signs in with phishing-resistant MFA, their account must not keep any weaker MFA metho

Enforced Screen Lock With Full Re-Authentication After Inactivity

Systems lock within 15 minutes of inactivity (or on demand), hide everything on screen, stay awake u

Eliminating Security Questions for Authentication

Authentication should not use security questions as they can be easily compromised.

Avoid Email for Out-of-Band Authentication

Do not use email for secondary authentication steps to increase security.

Assign Each AI Agent a Unique Identity Distinct from Personnel Accounts

Every AI agent gets its own identity. It must never run under a person's user account or share an id

Develop, Maintain and Regularly Verify an AI Agent Register

Keep a single, current record of every AI agent operating in the organisation, and check it regularl

Recording Identifier, Owner, Identities, Credentials and Access for Each AI Agent

Every AI agent gets a register entry that names it, says who owns it and why it exists, and lists th

Enforcing Risk-Based Access Decisions Informed by Contextual Signals

Access to systems and their resources is granted, stepped up or denied according to the risk of each

Block User OAuth Consent, Reserve It for Authorised Administrators

Ordinary users cannot approve third-party OAuth apps to access organisational data or accounts. Only

Six-Monthly Review of OAuth Application Consents and Granted Permissions

Check every OAuth app consent and its permissions at least twice a year, then revoke apps nobody use

Central Logging of Third-Party OAuth Consent, Token Issuance and Use

Send every third-party OAuth consent grant, token issuance and token use event from your identity pl

Disable OAuth Device Code Flow Unless Required and Restrict Its Use

Turn off the OAuth device code sign-in flow by default, and where a genuine need exists, allow it on

Back to the full Australian Government Information Security Manual control list, or browse the complete control library.