Australian Information Security Manual ISM-1795: Credentials for built-in Administrator accounts, break glass accounts, local administrator

Credentials for built-in Administrator accounts, break glass accounts, local administrator accounts and service accounts are a minimum of 30 characters.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in Guidelines for system hardening

ISM-0341 Automatic execution features for removable media are disabled.
ISM-0343 If there is no business requirement for writing to removable media and devices, such funct
ISM-0345 External communication interfaces that allow DMA are disabled.
ISM-0380 Unneeded user accounts, components, services and functionality of operating systems are di
ISM-0382 Unprivileged users do not have the ability to uninstall or disable approved applications.
ISM-0383 Default user accounts or credentials for operating systems, including for any pre-configur
ISM-0408 Systems have a logon banner that reminds users of their security responsibilities when acc
ISM-0417 When systems cannot support multi-factor authentication, single-factor authentication usin

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All Australian Information Security Manual controls