ISM-0421 asks that any password which is the only thing proving who someone is, on non-classified, OFFICIAL: Sensitive and PROTECTED systems, is at least 15 characters long. Where a second factor protects the sign-in, ISM-1559 allows a shorter password, which is why the Information Security Manual treats multi-factor authentication as the first answer and 15 characters as the rule for whatever still signs in with a password alone.
A password used for single-factor authentication has at least 15 characters. ASD's terminology makes "password" a wide word: "A sequence of characters used for authentication. Passwords consisting solely of numbers are also known as personal identification numbers, while passwords consisting solely of a sequence of words are also known as passphrases." So PINs and passphrases count too.
It covers every account. ASD's credential guidance "is equally applicable to all user accounts unless specified otherwise", including break glass and service accounts, and to "interactive authentication and non-interactive authentication", so scripts count, and so do customers of your online services.
ISM-0421 applies to non-classified, OFFICIAL: Sensitive and PROTECTED systems; SECRET and TOP SECRET systems need 17 and 20 characters (ISM-1557 and ISM-0422). It is not part of the Essential Eight, although multi-factor authentication is. ISM-0417 sets the order of preference: "When systems cannot support multi-factor authentication, single-factor authentication using passwords is implemented instead."
The ISM has no separate definition: single-factor is whatever falls short of multi-factor, which ASD defines as "Authentication using two or more different authentication factors", from "something people know, something people have or something people are". ASD's Implementing multi-factor authentication adds that the factors must "authenticate a single claimant to a single authentication verifier": one person, checked at one point. ISM-1401 then requires something people have, either alongside something people know or unlocked by something people know or are. That catches more sign-ins than most password policies assume:
Each of these needs 15 characters.
It depends on what the PIN unlocks. A PIN that unlocks a key on a smart card, security key or computer's security chip, which then signs the person in elsewhere, is part of passwordless multi-factor authentication: ASD says a password used "to unlock access to a cryptographic private key stored on a device" is "not a primary authentication factor". ISM-1559's 6 characters applies. A PIN that opens the device itself works alone, because holding a device cannot be the second factor for unlocking that same device. ASD's configuration guidance draws the same line:
| The PIN | What it opens | Minimum |
|---|---|---|
| Smart card, security key or passkey PIN | A key that signs the person in elsewhere | 6 (ISM-1559) |
| Computer sign-in PIN backed by the security chip | A key that signs the person in to the directory | 6, in ASD's Windows guide |
| Phone or tablet passcode | The device (ISM-1888) | 15, in ASD's Blueprint |
| Drive encryption start-up PIN | The encrypted drive (ISM-2109) | 15, in ASD's Windows guide |
| PIN standing in for a password at sign-in | The account, nothing else checked | 15; ASD's Windows guide turns it off |
| PIN alone for a website, phone line or voicemail | The account, nothing else checked | 15 |
| Code from an authenticator app, token or text | Nothing: it shows the person holds the device | Not a password, so ISM-0421 does not apply |
ASD's Hardening Microsoft Windows 11 workstations describes the sign-in PIN as used "to unlock the use of asymmetric cryptography stored in a TPM in order to authenticate users". ASD's Blueprint for Secure Cloud sets a phone "passcode of 15 characters or above", "in line with ISM requirements on password length". The last row is our reading: ASD lists a "one-time password token" as something people have. NIST calls unlock PINs "activation secrets" that "are not sent to the verifier", and recommends at least six characters (NIST).
ASD names the threat: "A significant threat to the compromise of user accounts is password cracking tools." With "a list of usernames and hashed passwords from a system", malicious actors can "recover username and password pairs by comparing the hashes of known passwords with the hashed passwords they have gained access to." Account lockouts do not help, because the guessing happens on their own computers. What decides the outcome is how the passwords were stored (our ISM-1402 guide covers this) and how long they are: every extra character multiplies the guesses needed.
NIST sets the same number: verifiers "SHALL require passwords that are used as a single-factor authentication mechanism to be a minimum of 15 characters in length" (NIST).
| Ask | Look at | Good looks like |
|---|---|---|
| Which sign-ins rely on a password or PIN alone? | An inventory of systems and how each signs people in | Every one listed, with the reason multi-factor authentication is not possible (ISM-0417) |
| What minimum does each enforce? | Password and PIN settings, and a test change with 14 characters | 15 characters or more (17 or 20 on SECRET or TOP SECRET systems); the test is refused |
| Are older short passwords gone? | Last password change dates against the date the minimum went up | Changed since, or a dated plan |
| Is the second factor on every sign-in? | Multi-factor authentication settings and sign-in logs | No "remember this computer", network or device exemptions; these passwords and unlock PINs at least 6 characters (ISM-1559) |
| Are administrator and service account credentials long and random? | The password manager or privileged access tool | At least 30 random characters (ISM-1795) |
| Does the written standard match? | The password standard and the exceptions register | 15 characters for single-factor sign-in; every exception owned and dated |
Platforms with built-in limits. Microsoft documents the password policy for accounts created in Microsoft Entra ID as "A minimum of 8 characters and a maximum of 256 characters" and says, "Unless noted, you can't change these settings" (Microsoft). For accounts like these, make sure the password never works alone: multi-factor authentication on every sign-in, with older sign-in methods that bypass it switched off.
Old devices and applications. Some accept only short passwords. Put them behind a jump server with multi-factor authentication, limit who can reach them, and list them as exceptions until they are replaced.
People. Four or five random words usually clear 15 characters and are easier to type on a phone than a short string of symbols; ASD suggests "a random mix of words, such as unrelated words from the page of a book" (ASD). Phone passcodes are the bigger change, so explain them first.
Customer-facing services. A long minimum adds friction at sign-up. Passkeys or multi-factor authentication take customers out of single-factor sign-in, and ISM-1892 asks for multi-factor authentication where an online customer service holds sensitive customer data.
Smaller and larger organisations. A smaller organisation with multi-factor authentication already on its cloud accounts is left with computer sign-ins, phones, local accounts and a few applications. A larger one faces several directories, legacy applications and service accounts: an inventory and a change programme.
The business case. The setting costs little; testing, help desk calls and replacing what cannot comply cost more. In return, a copied password list becomes much harder to turn into working sign-ins.
Which of your current licences already provide these? The free coverage check shows which ISM and Essential Eight controls the products you already pay for can reach, in about three minutes. To see ISM-0421 beside the other password controls, open it in our sample coverage report, or read what an ISM assessment involves.
ISM-0421 is at revision 11, last updated in December 2025. ASD's December 2025 change report says the earlier version recommended that "passphrases used for single-factor authentication on non-classified, OFFICIAL: Sensitive and PROTECTED systems are at least 4 random words with a total minimum length of 15 characters", and that it "was amended to move the reference to 4 random words to ISM-1558". The same release replaced "passphrases" with "passwords" across the password controls "to align with preferred language under the finalised NIST SP 800-63B-4 publication" (ASD). In September 2026 ISM-0421 moved to "Guidelines for system access › Credential management", wording unchanged (ASD); our ISM September 2026 summary covers the rest.