Australian Information Security Manual ISM-1558: Passwords using a sequence of words for single-factor authentication are not constructed u

Passwords using a sequence of words for single-factor authentication are not constructed using: - a list of categorised words - a real sentence in a natural language - song lyrics, movie or television show quotes, literature, or any other publicly available material - less than 4 random words for non-classified, OFFICIAL: Sensitive and PROTECTED systems; 5 random words for SECRET systems; or 6 random words for TOP SECRET systems.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in Guidelines for system hardening

ISM-0341 Automatic execution features for removable media are disabled.
ISM-0343 If there is no business requirement for writing to removable media and devices, such funct
ISM-0345 External communication interfaces that allow DMA are disabled.
ISM-0380 Unneeded user accounts, components, services and functionality of operating systems are di
ISM-0382 Unprivileged users do not have the ability to uninstall or disable approved applications.
ISM-0383 Default user accounts or credentials for operating systems, including for any pre-configur
ISM-0408 Systems have a logon banner that reminds users of their security responsibilities when acc
ISM-0417 When systems cannot support multi-factor authentication, single-factor authentication usin

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All Australian Information Security Manual controls