[
  {
    "id": "ISM-2080",
    "slug": "ism-2080",
    "title": "ISM-2080: Why Password Complexity Rules Are Out",
    "description": "ASD's ISM-2080 says not to impose password complexity rules. What it means, why length and banned-password checks work better, and the evidence to keep.",
    "controls": [
      "ISM-2080",
      "ISM-0421",
      "ISM-1559",
      "ISM-1558",
      "ISM-2078",
      "ISM-2079",
      "ISM-2081"
    ],
    "status": "published",
    "published": "2026-10-04",
    "updated": "2026-10-04",
    "checkedAgainst": "2026.09.4",
    "reviewedBy": "Greg Tereszczyn",
    "reviewedOn": "2026-10-04",
    "image": {
      "src": "/content/ism/images/ism-2080.webp",
      "thumb": "/content/ism/images/ism-2080-thumb.webp",
      "card": "/content/ism/images/ism-2080-card.jpg",
      "alt": "Patch, the TERESEC cat mascot, shredding a sticky note of password complexity rules while holding a tablet with a long passphrase: ISM-2080, no password complexity requirements",
      "width": 800,
      "height": 533
    },
    "glance": [
      {
        "icon": "check",
        "title": "Stop forcing character mixes",
        "text": "People may use symbols; no system may demand them."
      },
      {
        "icon": "length",
        "title": "Require length instead",
        "text": "15 characters or more, and block common and breached passwords."
      },
      {
        "icon": "lock",
        "title": "Put MFA in front",
        "text": "Multi-factor authentication matters more than any password rule."
      }
    ]
  },
  {
    "id": "ISM-1685",
    "slug": "ism-1685",
    "title": "ISM-1685: Passwords for Admin and Service Accounts",
    "description": "ISM-1685 says break glass, local admin and service account credentials must be long, unique, random and managed. What that means and the evidence to keep.",
    "controls": [
      "ISM-1685",
      "ISM-1795",
      "ISM-1954",
      "ISM-1953",
      "ISM-1619",
      "ISM-1614",
      "ISM-1615"
    ],
    "status": "published",
    "published": "2026-10-04",
    "updated": "2026-10-04",
    "checkedAgainst": "2026.09.4",
    "reviewedBy": "Greg Tereszczyn",
    "reviewedOn": "2026-10-04",
    "image": {
      "src": "/content/ism/images/ism-1685.webp",
      "thumb": "/content/ism/images/ism-1685-thumb.webp",
      "card": "/content/ism/images/ism-1685-card.jpg",
      "alt": "Patch, the TERESEC cat mascot, checking a break glass key cabinet holding separate long, unique keys for administrator, emergency and service accounts: ISM-1685, managed privileged account credentials",
      "width": 800,
      "height": 533
    },
    "glance": [
      {
        "icon": "length",
        "title": "At least 30 random characters",
        "text": "For break glass, local administrator and service accounts (ISM-1795, ISM-1954)."
      },
      {
        "icon": "key",
        "title": "A different one everywhere",
        "text": "No two accounts or devices share a credential, so one stolen password opens nothing else."
      },
      {
        "icon": "refresh",
        "title": "Held and changed by a tool",
        "text": "Stored, rotated and logged by a tool, not remembered by a person."
      }
    ]
  },
  {
    "id": "ISM-2121",
    "slug": "ism-2121",
    "title": "ISM-2121: Security Skills for Software Developers",
    "description": "ISM-2121 says developers without the security skills a task needs are not used for it. What that means for staff, contractors and AI, and the evidence.",
    "controls": [
      "ISM-2121",
      "ISM-2035",
      "ISM-2036",
      "ISM-2038",
      "ISM-2037",
      "ISM-2120",
      "ISM-2040"
    ],
    "status": "published",
    "published": "2026-10-06",
    "updated": "2026-10-06",
    "checkedAgainst": "2026.09.4",
    "reviewedBy": "Greg Tereszczyn",
    "reviewedOn": "2026-10-06",
    "image": {
      "src": "/content/ism/images/ism-2121.webp",
      "thumb": "/content/ism/images/ism-2121-thumb.webp",
      "card": "/content/ism/images/ism-2121-card.jpg",
      "alt": "Patch, the TERESEC cat mascot, teaching secure coding to a row of rubber ducks at laptops: ISM-2121, software developers need cyber security skills",
      "width": 800,
      "height": 533
    },
    "glance": [
      {
        "icon": "check",
        "title": "Match skills to the work",
        "text": "Decide what security knowledge each kind of work needs, record each developer against it (ISM-2038) and assign work to match."
      },
      {
        "icon": "refresh",
        "title": "Train before you assign",
        "text": "Close a gap with training or upskilling (ISM-2037), pairing or reassignment before the work starts."
      },
      {
        "icon": "shield",
        "title": "Include contractors and AI",
        "text": "Everyone who writes your code is in scope, and whoever reviews AI-generated code needs the skills the task needs."
      }
    ],
    "bodyHtml": "/content/ism/ism-2121.body.html"
  },
  {
    "id": "ISM-0428",
    "slug": "ism-0428",
    "title": "ISM-0428: Lock Idle Sessions After 15 Minutes",
    "description": "ISM-0428 says online services lock after 15 idle minutes or 12 hours in all, and unlock only with every factor. What that means and the evidence to keep.",
    "controls": [
      "ISM-0428",
      "ISM-2012",
      "ISM-1888",
      "ISM-0853",
      "ISM-2066",
      "ISM-2147",
      "ISM-2148"
    ],
    "status": "published",
    "published": "2026-10-07",
    "updated": "2026-10-07",
    "checkedAgainst": "2026.09.4",
    "reviewedBy": "Greg Tereszczyn",
    "reviewedOn": "2026-10-07",
    "image": {
      "src": "/content/ism/images/ism-0428.webp",
      "thumb": "/content/ism/images/ism-0428-thumb.webp",
      "card": "/content/ism/images/ism-0428-card.jpg",
      "alt": "Patch, the TERESEC cat mascot, walking away for coffee while the web application left open on the screen locks its session: ISM-0428, session lock after 15 minutes of inactivity",
      "width": 800,
      "height": 533
    },
    "glance": [
      {
        "icon": "lock",
        "title": "Lock after 15 idle minutes",
        "text": "Every service people sign in to locks the session after 15 minutes of inactivity, or when the person locks it."
      },
      {
        "icon": "refresh",
        "title": "Sign in again within 12 hours",
        "text": "No session runs longer than 12 hours without a fresh sign-in, however busy the person is."
      },
      {
        "icon": "key",
        "title": "Unlock with every factor",
        "text": "Getting back in takes the full sign-in, and nobody can switch the lock off for themselves."
      }
    ],
    "bodyHtml": "/content/ism/ism-0428.body.html"
  },
  {
    "id": "ISM-1648",
    "slug": "ism-1648",
    "title": "ISM-1648: Disable Idle Admin Access After 45 Days",
    "description": "ISM-1648 says privileged access is disabled after 45 days without use. What counts as inactive, how to automate it, the exceptions and evidence to keep.",
    "controls": [
      "ISM-1648",
      "ISM-1647",
      "ISM-1404",
      "ISM-0430",
      "ISM-1591",
      "ISM-0445",
      "ISM-1507",
      "ISM-1509"
    ],
    "status": "published",
    "published": "2026-10-09",
    "updated": "2026-10-09",
    "checkedAgainst": "2026.09.4",
    "reviewedBy": "Greg Tereszczyn",
    "reviewedOn": "2026-10-09",
    "image": {
      "src": "/content/ism/images/ism-1648.webp",
      "thumb": "/content/ism/images/ism-1648-thumb.webp",
      "card": "/content/ism/images/ism-1648-card.jpg",
      "alt": "Patch, the TERESEC cat mascot, switching off a dusty administrator badge that nobody has used for 45 days: ISM-1648, privileged access disabled after 45 days of inactivity",
      "width": 800,
      "height": 533
    },
    "glance": [
      {
        "icon": "lock",
        "title": "Disable after 45 idle days",
        "text": "Privileged access nobody has used for 45 days is switched off, by a check that runs every day."
      },
      {
        "icon": "key",
        "title": "Use dedicated admin accounts",
        "text": "A separate privileged account (ISM-0445) shows when admin access was last used; admin rights on an everyday account never look idle."
      },
      {
        "icon": "check",
        "title": "Check before switching back on",
        "text": "Disabled access comes back only through a request checked like a new one (ISM-1507)."
      }
    ],
    "bodyHtml": "/content/ism/ism-1648.body.html"
  }
]