Break glass, local administrator and service account passwords are long, unique, unpredictable and managed, and default passwords are changed

Credentials for break glass accounts, local administrator accounts and service accounts are long, unique, unpredictable and managed. Required at Maturity Levels Two and Three of the Restrict administrative privileges mitigation strategy (Appendices B and C); ISM control ISM-1685 in ASD's Essential Eight to ISM mapping (December 2023).

evidence an assessor asks for Privileged access management vault records for break glass, local administrator and service account credentials; Local administrator password solution configuration and rotation logs

Where a system or application account is capable of interactive login, it must be managed so that: interactive use is prevented unless an exceptional circumstance requires it; interactive use lasts no longer than the exceptional circumstance requires; the business justification is documented; management explicitly approves interactive use; the individual's identity is verified before the account is made available; and each action performed is attributable to one individual user. The guidance advises that, where possible, such accounts be configured to disallow interactive login and limited to specific machines and devices. Objective under the customized approach: whenever system or application accounts are used interactively, each action is authorized and traceable to one person. Future-dated: treated as a best practice up to 31 March 2025 and mandatory since then.

evidence an assessor asks for List of application and system accounts with interactive logon capability flagged; Configuration denying interactive logon for service accounts (for example logon rights policies); Approval and justification records for each interactive use; Vault or PAM session logs tying interactive use to a named individual

Give every enterprise asset its own unique password. Good practice sets a floor of 8 characters for accounts protected by MFA and 14 characters for accounts without MFA.

evidence an assessor asks for Password policy configuration enforcing 8-character minimum with MFA and 14 without; Privileged access tool records showing unique local administrator passwords per asset; Local administrator password solution deployment report showing coverage across workstations and servers; Network device and appliance credential vault entries showing a distinct password per device; Directory fine-grained password policy for accounts not protected by MFA showing the 14-character minimum

Control the default accounts that come with enterprise assets and software, for example root, administrator and other accounts preset by vendors, by disabling them or rendering them unusable.

evidence an assessor asks for Default account inventory and configuration showing default accounts disabled or renamed with changed credentials; Scan results confirming no vendor default credentials remain active; Hardening checklist entries showing root, administrator and vendor preset accounts handled at build time; Credential audit results for network devices, appliances and databases testing for vendor defaults; Service account inventory showing default vendor accounts disabled or password changed

Identities and credentials for authorized users, services, and hardware are managed by the organization

evidence an assessor asks for Identity management platform configuration baseline; Joiner mover leaver workflow with timing SLAs; Service account inventory with owners; Hardware credential inventory and reconciliation; Quarterly identity hygiene reports

Where a system or application account is capable of interactive login, it must be managed so that: interactive use is prevented unless an exceptional circumstance requires it; interactive use lasts no longer than the exceptional circumstance requires; the business justification is documented; management explicitly approves interactive use; the individual's identity is verified before the account is made available; and each action performed is attributable to one individual user. The guidance advises that, where possible, such accounts be configured to disallow interactive login and limited to specific machines and devices. Objective under the customized approach: whenever system or application accounts are used interactively, each action is authorized and traceable to one person. Future-dated: treated as a best practice up to 31 March 2025 and mandatory since then.

evidence an assessor asks for List of application and system accounts with interactive logon capability flagged; Configuration denying interactive logon for service accounts (for example logon rights policies); Approval and justification records for each interactive use; Vault or PAM session logs tying interactive use to a named individual

Change any default passwords on devices and software before deployment, or remove the account if not needed.

evidence an assessor asks for deployment checklist; credential vault entries; no-default attestation

Change all default administrative passwords on boundary firewalls to a non-guessable password, or disable remote admin access entirely.

evidence an assessor asks for admin account list; password change log/attestation; config snapshot

Where a system or application account is capable of interactive login, it must be managed so that: interactive use is prevented unless an exceptional circumstance requires it; interactive use lasts no longer than the exceptional circumstance requires; the business justification is documented; management explicitly approves interactive use; the individual's identity is verified before the account is made available; and each action performed is attributable to one individual user. The guidance advises that, where possible, such accounts be configured to disallow interactive login and limited to specific machines and devices. Objective under the customized approach: whenever system or application accounts are used interactively, each action is authorized and traceable to one person. Future-dated: treated as a best practice up to 31 March 2025 and mandatory since then.

evidence an assessor asks for List of application and system accounts with interactive logon capability flagged; Configuration denying interactive logon for service accounts (for example logon rights policies); Approval and justification records for each interactive use; Vault or PAM session logs tying interactive use to a named individual

Secure authentication technologies and procedures are to be put in place, driven by the information access restrictions and the access control policy. Purpose (stated in ISO/IEC 27002:2022): ensures users and entities are securely authenticated when granted access to systems, applications and services. As an Annex A reference control, it is compared with the controls determined in risk treatment (6.1.3 c) and recorded in the Statement of Applicability as included or excluded, with the justification and implementation status (6.1.3 d); implementation guidance is ISO/IEC 27002:2022 8.5.

evidence an assessor asks for Statement of Applicability entry for control A.8.5, showing inclusion or justified exclusion, implementation status and the risks it treats; An authentication standard linking required authentication strength to information classification and system criticality; MFA configuration and coverage reports for critical systems, remote access and privileged access, including conditional or risk-based rules; Log-on configuration showing warning banners, generic error messages, lockout or throttling after failed attempts and masked password entry; Authentication logs recording successful and failed attempts, with alerting on suspected brute force