ISM control lookup / Topic

Guidelines for system access

123 controls · September 2026 edition

• ISM-0078 · Control of Australian systems

  Systems processing, storing or communicating AUSTEO or AGAO data remain at all times under the control of an Australian national working for or on behalf of the Australian Government.

• ISM-0405 · Unprivileged access to systems

  Requests for unprivileged access to systems and their resources are validated when first requested.

• ISM-0407 · Recording authorisation for personnel to access systems

  A secure record is maintained for the life of systems and their resources that covers the following for each human user:

• ISM-0408 · System access requirements

  Systems have a logon banner that reminds personnel of their security responsibilities when accessing the system and its resources.

• ISM-0409 · Unprivileged access to systems by foreign nationals

  Foreign nationals, including seconded foreign nationals, do not have access to systems that process, store or communicate AUSTEO or REL data unless effective security controls are in place to ensure such data is not accessible to them.

• ISM-0411 · Unprivileged access to systems by foreign nationals

  Foreign nationals, excluding seconded foreign nationals, do not have access to systems that process, store or communicate AGAO data unless effective security controls are in place to ensure such data is not accessible to them.

• ISM-0414 · User identification

  Users granted access to systems and their resources are uniquely identifiable.

• ISM-0415 · User identification

  The use of shared user accounts is strictly controlled, and users of such accounts are uniquely identifiable.

• ISM-0417 · Single-factor authentication

  When systems cannot support multi-factor authentication, single-factor authentication using passwords is implemented instead.

• ISM-0418 · Protecting credentials

  Physical credentials are kept separate from systems they are used to authenticate to, except for when performing authentication activities.

• ISM-0420 · User identification

  Where systems process, store or communicate AUSTEO, AGAO or REL data, personnel who are foreign nationals are identified as such, including by their specific nationality.

• ISM-0421 · Password strength

  Passwords used for single-factor authentication on non-classified, OFFICIAL: Sensitive and PROTECTED systems are a minimum of 15 characters.

• ISM-0422 · Password strength

  Passwords used for single-factor authentication on TOP SECRET systems are a minimum of 20 characters.

• ISM-0428 · Session locking

  Services are configured with a session lock that:

• ISM-0430 · Suspension of access to systems

  Access to systems and their resources are removed or suspended the same day users no longer have a legitimate requirement for access.

• ISM-0432 · System access requirements

  Access requirements for systems and their resources are documented in their system security plan.

• ISM-0434 · System access requirements

  Personnel undergo appropriate employment screening and, where necessary, hold an appropriate security clearance before being granted access to systems and their resources.

• ISM-0435 · System access requirements

  Personnel receive any necessary briefings before being granted access to systems and their resources.

• ISM-0441 · Temporary access to systems

  When personnel are granted temporary access to systems and their resources, effective security controls are put in place to restrict their access to only data required for them to undertake their duties or functions.

• ISM-0443 · Temporary access to systems

  Temporary access is not granted to systems that process, store or communicate caveated or sensitive compartmented information.

• ISM-0445 · Privileged access to systems

  Privileged human users are assigned a dedicated privileged user account to be used solely for duties requiring privileged access.

• ISM-0446 · Privileged access to systems by foreign nationals

  Foreign nationals, including seconded foreign nationals, do not have privileged access to systems that process, store or communicate AUSTEO or REL data.

• ISM-0447 · Privileged access to systems by foreign nationals

  Foreign nationals, excluding seconded foreign nationals, do not have privileged access to systems that process, store or communicate AGAO data.

• ISM-0853 · Session termination

  Interactive user sessions are terminated and workstations are restarted at least daily.

• ISM-0854 · Control of Australian systems

  AUSTEO and AGAO data can only be accessed from systems under the sole control of the Australian Government that are located within facilities authorised by the Australian Government.

• ISM-0974 · Multi-factor authentication

  Multi-factor authentication is used to authenticate unprivileged human users of systems.

• ISM-1055 · Insecure authentication methods

  LAN Manager and NT LAN Manager authentication methods are disabled.

• ISM-1173 · Multi-factor authentication

  Multi-factor authentication is used to authenticate privileged human users of systems.

• ISM-1175 · Privileged access to systems

  Privileged user accounts (excluding those explicitly authorised to access online services) are prevented from accessing the internet, email and web services.

• ISM-1227 · Setting credentials for user accounts

  Credentials set for user accounts are randomly generated.

• ISM-1263 · Privileged access to systems

  Unique privileged user accounts are used for administering individual server applications.

• ISM-1401 · Multi-factor authentication

  Multi-factor authentication uses either: something people have and something people know, or something people have that is unlocked by something people know or are.

• ISM-1402 · Protecting credentials

  Credentials stored on systems are protected by a password manager; a hardware security module; or by salting, hashing and stretching them before storage within a database.

• ISM-1403 · User account lockouts

  User accounts, except for break glass accounts, are protected by fixed or risk-based lockout mechanisms aligned to a maximum of five failed logon attempts, with either indefinite or automated lockout durations.

• ISM-1404 · Suspension of access to systems

  Unprivileged access to systems and their resources are disabled after 45 days of inactivity.

• ISM-1504 · Multi-factor authentication

  Multi-factor authentication is used to authenticate human users to their organisation’s online services that process, store or communicate their organisation’s sensitive data.

• ISM-1505 · Multi-factor authentication

  Multi-factor authentication is used to authenticate human users of data repositories.

• ISM-1507 · Privileged access to systems

  Requests for privileged access to systems and their resources are validated when first requested.

• ISM-1508 · Privileged access to systems

  Privileged access to systems and their resources is limited to only what is required for users to undertake their duties or functions.

• ISM-1509 · Privileged access to systems

  Privileged access events are centrally logged.

• ISM-1546 · Authenticating to systems

  Users are authenticated before they are granted access to a system and its resources.

• ISM-1557 · Password strength

  Passwords used for single-factor authentication on SECRET systems are a minimum of 17 characters.

• ISM-1558 · Password strength

  Passwords using a sequence of words for single-factor authentication are not constructed using:

• ISM-1559 · Password strength

  Passwords used for multi-factor authentication on non-classified, OFFICIAL: Sensitive and PROTECTED systems are a minimum of 6 characters.

• ISM-1560 · Password strength

  Passwords used for multi-factor authentication on SECRET systems are a minimum of 8 characters.

• ISM-1561 · Password strength

  Passwords used for multi-factor authentication on TOP SECRET systems are a minimum of 10 characters.

• ISM-1566 · Unprivileged access to systems

  Use of unprivileged access is centrally logged.

• ISM-1583 · User identification

  Personnel who are contractors are identified as such.

• ISM-1590 · Changing credentials

  Credentials for user accounts are changed if:

• ISM-1591 · Suspension of access to systems

  Access to systems and their resources are removed or suspended as soon as practicable when users are detected undertaking malicious activities.

• ISM-1593 · Setting credentials for user accounts

  Human users provide sufficient evidence to verify their identity when first requesting credentials, when requesting the reset of any credentials, when requesting the temporary disabling of any credentials, and when requesting the enrolment or re-enrolment of any credentials.

• ISM-1594 · Setting credentials for user accounts

  Credentials for human users are provided via a secure communications channel or, if not possible, split into two parts with one part provided to the human user and the other part provided to their supervisor.

• ISM-1595 · Setting credentials for user accounts

  Credentials provided to human users are changed on first use.

• ISM-1596 · Setting credentials for user accounts

  Credentials are not reused by users across different systems.

• ISM-1597 · Protecting credentials

  Credentials are obscured as they are entered into systems.

• ISM-1603 · Insecure authentication methods

  Authentication methods susceptible to replay attacks are disabled.

• ISM-1610 · Emergency access to systems

  A method of emergency access to systems and their resources is documented and tested at least once when initially implemented and each time fundamental information technology infrastructure changes occur.

• ISM-1611 · Emergency access to systems

  Break glass accounts are only used when normal authentication processes cannot be used.

• ISM-1612 · Emergency access to systems

  Break glass accounts are only used for specific authorised activities.

• ISM-1613 · Emergency access to systems

  Use of break glass accounts is centrally logged.

• ISM-1614 · Emergency access to systems

  Break glass account credentials are changed by the account custodian after they are accessed by any other party.

• ISM-1615 · Emergency access to systems

  Break glass accounts are tested after credentials are changed.

• ISM-1619 · Setting credentials for built-in Administrator accounts, break glass accounts, local administrator accounts and service accounts

  Service accounts are created as group Managed Service Accounts.

• ISM-1647 · Suspension of access to systems

  Privileged access to systems and their resources are disabled after 12 months unless revalidated.

• ISM-1648 · Suspension of access to systems

  Privileged access to systems and their resources are disabled after 45 days of inactivity.

• ISM-1649 · Privileged access to systems

  Just-in-time administration is used for the administration of systems and their resources.

• ISM-1650 · Privileged access to systems

  Privileged user account and security group management events are centrally logged.

• ISM-1679 · Multi-factor authentication

  Multi-factor authentication is used to authenticate human users to third-party online services that process, store or communicate their organisation’s sensitive data.

• ISM-1680 · Multi-factor authentication

  Multi-factor authentication (where available) is used to authenticate human users to third-party online services that process, store or communicate their organisation’s non-sensitive data.

• ISM-1681 · Multi-factor authentication

  Multi-factor authentication is used to authenticate customers to online customer services that process, store or communicate sensitive customer data.

• ISM-1682 · Multi-factor authentication

  Multi-factor authentication used for authenticating human users of systems is phishing-resistant.

• ISM-1683 · Multi-factor authentication

  Successful and unsuccessful multi-factor authentication events are centrally logged.

• ISM-1685 · Setting credentials for built-in Administrator accounts, break glass accounts, local administrator accounts and service accounts

  Credentials for break glass accounts, local administrator accounts and service accounts are long, unique, unpredictable and managed.

• ISM-1686 · Protecting credentials

  Credential Guard functionality is enabled.

• ISM-1749 · Protecting credentials

  Cached credentials are limited to one previous logon.

• ISM-1795 · Setting credentials for built-in Administrator accounts, break glass accounts, local administrator accounts and service accounts

  Credentials for built-in Administrator accounts, break glass accounts, local administrator accounts and service accounts are a minimum of 30 characters.

• ISM-1847 · Changing credentials

  Credentials for the Kerberos Key Distribution Center’s service account (KRBTGT) are changed twice, allowing for replication to all Microsoft AD DS domain controllers in-between each change, if the domain has been directly compromised, the domain is suspected of being compromised or they have not been changed in the past six months.

• ISM-1852 · Unprivileged access to systems

  Unprivileged access to systems and their resources is limited to only what is required for users to undertake their duties or functions.

• ISM-1861 · Protecting credentials

  Local Security Authority protection functionality is enabled.

• ISM-1864 · System usage policy

  A system usage policy is developed, implemented and maintained.

• ISM-1865 · System access requirements

  Personnel agree to abide by system usage policies before being granted access to systems and their resources.

• ISM-1872 · Multi-factor authentication

  Multi-factor authentication used for authenticating human users of online services is phishing-resistant.

• ISM-1873 · Multi-factor authentication

  Multi-factor authentication used for authenticating customers of online customer services provides a phishing-resistant option.

• ISM-1874 · Multi-factor authentication

  Multi-factor authentication used for authenticating customers of online customer services is phishing-resistant.

• ISM-1875 · Protecting credentials

  Systems are scanned at least monthly to identify any credentials that are being stored in the clear.

• ISM-1883 · Privileged access to systems

  Privileged user accounts explicitly authorised to access online services are strictly limited to only what is required for users to undertake their duties or functions.

• ISM-1892 · Multi-factor authentication

  Multi-factor authentication is used to authenticate human users to their organisation’s online customer services that process, store or communicate their organisation’s sensitive customer data.

• ISM-1893 · Multi-factor authentication

  Multi-factor authentication is used to authenticate human users to third-party online customer services that process, store or communicate their organisation’s sensitive customer data.

• ISM-1894 · Multi-factor authentication

  Multi-factor authentication used for authenticating human users of data repositories is phishing-resistant.

• ISM-1895 · Single-factor authentication

  Successful and unsuccessful single-factor authentication events are centrally logged.

• ISM-1897 · Protecting credentials

  Remote Credential Guard functionality is enabled.

• ISM-1919 · Multi-factor authentication

  When multi-factor authentication is used to authenticate human users or customers to online services or online customer services, all other authentication protocols that do not support multi-factor authentication are disabled.

• ISM-1920 · Multi-factor authentication

  When multi-factor authentication is used to authenticate human users to online services, online customer services, systems or data repositories – that process, store or communicate their organisation’s sensitive data or sensitive customer data – human users are prevented from self-enrolling into multi-factor authentication from untrustworthy devices.

• ISM-1953 · Setting credentials for built-in Administrator accounts, break glass accounts, local administrator accounts and service accounts

  Credentials for the built-in Administrator account in each domain are long, unique, unpredictable and managed.

• ISM-1954 · Setting credentials for built-in Administrator accounts, break glass accounts, local administrator accounts and service accounts

  Credentials for built-in Administrator accounts, break glass accounts, local administrator accounts and service accounts are randomly generated.

• ISM-1955 · Changing credentials

  Credentials for computer accounts are changed if they are compromised, they are suspected of being compromised or they have not been changed in the past 30 days.

• ISM-1956 · Changing credentials

  Microsoft AD FS token-signing and encryption certificates are changed twice in quick succession if they are compromised, they are suspected of being compromised or they have not been changed in the past 12 months.

• ISM-1957 · Protecting credentials

  Private keys for Microsoft AD CS certification authority servers are protected by a hardware security module.

• ISM-1980 · Protecting credentials

  Credential hint functionality is not used for systems.

• ISM-2011 · Multi-factor authentication

  When phishing-resistant multi-factor authentication is used by human users, other non-phishing-resistant multi-factor authentication options are disabled for their user accounts.

• ISM-2012 · Screen locking

  Systems are configured with a screen lock that:

• ISM-2076 · Insecure authentication methods

  Security questions are not used for authentication purposes.

• ISM-2077 · Insecure authentication methods

  Email is not used for out-of-band authentication purposes.

• ISM-2078 · Password strength

  Passwords appearing in lists of commonly used passwords or lists of compromised passwords are not used.

• ISM-2079 · Password strength

  Maximum length limits for passwords are not less than 64 characters.

• ISM-2080 · Password strength

  Password complexity requirements are not imposed for passwords.

• ISM-2081 · Password strength

  All ASCII printable characters are supported for passwords.

• ISM-2133 · Artificial intelligence agent identification

  Each AI agent is assigned a unique identity that is distinct from the user accounts of personnel and the identities of other AI agents.

• ISM-2134 · Artificial intelligence agent register

  An AI agent register is developed, implemented, maintained and regularly verified.

• ISM-2135 · Artificial intelligence agent register

  An AI agent register contains the following for each AI agent:

• ISM-2136 · Authenticating to systems

  Risk-based access decisions, informed by contextual signals, are enforced for access to systems and their resources.

• ISM-2137 · Third-party application access and device code authentication

  Human users are prevented from granting consent to third-party OAuth applications, with such consent granted only by an authorised administrator.

• ISM-2138 · Third-party application access and device code authentication

  OAuth application consents, including their granted permissions, are reviewed at least every six months, with unused applications and excessive permissions revoked.

• ISM-2139 · Third-party application access and device code authentication

  Consent grants, token issuance and token use for third-party OAuth applications are centrally logged.

• ISM-2140 · Third-party application access and device code authentication

  The OAuth device code authentication flow is disabled unless required, and where required, is restricted to authorised user accounts and managed devices.

• ISM-2141 · Application and workload credentials

  Applications and workloads use short-lived dynamically issued credentials in preference to long-lived static credentials.

• ISM-2142 · Application and workload credentials

  Static credentials used by applications and workloads are centrally managed using a credential or secrets management solution.

• ISM-2143 · Application and workload credentials

  Applications and workloads use unique credentials that are not shared with other applications or workloads, or across development, testing, staging and production environments.

• ISM-2144 · Changing credentials

  Static credentials used by applications and workloads are changed if:

• ISM-2145 · Revoking credentials

  Credentials for user accounts are revoked when they are no longer required.

• ISM-2146 · Revoking credentials

  Static credentials used by applications and workloads are revoked when they are no longer required.

• ISM-2147 · Protecting authentication artefacts

  Authentication tokens, session cookies and refresh tokens are cryptographically bound to the device on which they were issued.

• ISM-2148 · Protecting authentication artefacts

  Active sessions, refresh tokens and other authentication artefacts are revoked when credentials are reset or re-enrolled, when credentials are compromised or suspected of being compromised, when a device no longer meets compliance requirements, or when high-risk sign-in activity is detected.