# ISM-0421: Minimum Password Length of 15 Characters

ISM-0421 asks that any password which is the only thing proving who someone is, on non-classified, OFFICIAL: Sensitive and PROTECTED systems, is at least 15 characters long. Where a second factor protects the sign-in, ISM-1559 allows a shorter password, which is why the [Information Security Manual](https://www.cyber.gov.au/ism) treats multi-factor authentication as the first answer and 15 characters as the rule for whatever still signs in with a password alone.

## What does ISM-0421 require?

A password used for single-factor authentication has at least 15 characters. ASD's terminology makes "password" a wide word: "A sequence of characters used for authentication. Passwords consisting solely of numbers are also known as personal identification numbers, while passwords consisting solely of a sequence of words are also known as passphrases." So PINs and passphrases count too.

It covers every account. ASD's credential guidance "is equally applicable to all user accounts unless specified otherwise", including break glass and service accounts, and to "interactive authentication and non-interactive authentication", so scripts count, and so do customers of your online services.

ISM-0421 applies to non-classified, OFFICIAL: Sensitive and PROTECTED systems; SECRET and TOP SECRET systems need 17 and 20 characters (ISM-1557 and ISM-0422). It is not part of the [Essential Eight](/services/essential-eight), although multi-factor authentication is. ISM-0417 sets the order of preference: "When systems cannot support multi-factor authentication, single-factor authentication using passwords is implemented instead."

## What counts as single-factor authentication?

The ISM has no separate definition: single-factor is whatever falls short of multi-factor, which ASD defines as "Authentication using two or more different authentication factors", from "something people know, something people have or something people are". ASD's [Implementing multi-factor authentication](https://www.cyber.gov.au/publication/implementing-multi-factor-authentication) adds that the factors must "authenticate a single claimant to a single authentication verifier": one person, checked at one point. ISM-1401 then requires something people have, either alongside something people know or unlocked by something people know or are. That catches more sign-ins than most password policies assume:

- **Two things you know are one factor.** A password plus a security question, a memorable word or a second password is still single-factor.
- **A second factor somewhere else does not count.** In ASD's remote access example, a password and a one-time code open the VPN, then a password alone opens the domain, which "remains protected by single-factor authentication in the form of the user's password". The same applies to a computer sign-in with a password alone when only email asks for a second factor.
- **A device check is not the person's second factor.** A computer certificate plus the user's password is not multi-factor, because "the user and computer are considered separate claimants". So a rule that skips the second factor on the office network or a known computer leaves the password working alone.
- **"Remember this computer" drops back to one factor.** ASD says a method that can do this "is by definition no longer a multi-factor authentication method", as "subsequent authentications use a single factor (usually a password)".
- **A password and a fingerprint is not enough.** ASD says "the use of a memorised secret and biometrics is not recognised as a suitable form of multi-factor authentication", so we treat that password as single-factor.

Each of these needs 15 characters.

## Do PINs need 15 characters?

It depends on what the PIN unlocks. A PIN that unlocks a key on a smart card, security key or computer's security chip, which then signs the person in elsewhere, is part of passwordless multi-factor authentication: ASD says a password used "to unlock access to a cryptographic private key stored on a device" is "not a primary authentication factor". ISM-1559's 6 characters applies. A PIN that opens the device itself works alone, because holding a device cannot be the second factor for unlocking that same device. ASD's configuration guidance draws the same line:

| The PIN | What it opens | Minimum |
|---|---|---|
| Smart card, security key or passkey PIN | A key that signs the person in elsewhere | 6 (ISM-1559) |
| Computer sign-in PIN backed by the security chip | A key that signs the person in to the directory | 6, in ASD's Windows guide |
| Phone or tablet passcode | The device (ISM-1888) | 15, in ASD's Blueprint |
| Drive encryption start-up PIN | The encrypted drive (ISM-2109) | 15, in ASD's Windows guide |
| PIN standing in for a password at sign-in | The account, nothing else checked | 15; ASD's Windows guide turns it off |
| PIN alone for a website, phone line or voicemail | The account, nothing else checked | 15 |
| Code from an authenticator app, token or text | Nothing: it shows the person holds the device | Not a password, so ISM-0421 does not apply |

ASD's [Hardening Microsoft Windows 11 workstations](https://www.cyber.gov.au/business-government/protecting-devices-systems/hardening-systems-applications/system-hardening/hardening-microsoft-windows-11-workstations) describes the sign-in PIN as used "to unlock the use of asymmetric cryptography stored in a TPM in order to authenticate users". ASD's [Blueprint for Secure Cloud](https://blueprint.asd.gov.au/design/endpoints/ios/security/securing-ios-devices/) sets a phone "passcode of 15 characters or above", "in line with ISM requirements on password length". The last row is our reading: ASD lists a "one-time password token" as something people have. NIST calls unlock PINs "activation secrets" that "are not sent to the verifier", and recommends at least six characters ([NIST](https://pages.nist.gov/800-63-4/sp800-63b.html)).

## Why does password length matter?

ASD names the threat: "A significant threat to the compromise of user accounts is password cracking tools." With "a list of usernames and hashed passwords from a system", malicious actors can "recover username and password pairs by comparing the hashes of known passwords with the hashed passwords they have gained access to." Account lockouts do not help, because the guessing happens on their own computers. What decides the outcome is how the passwords were stored (our [ISM-1402 guide](/ism/ism-1402) covers this) and how long they are: every extra character multiplies the guesses needed.

NIST sets the same number: verifiers "SHALL require passwords that are used as a single-factor authentication mechanism to be a minimum of 15 characters in length" ([NIST](https://pages.nist.gov/800-63-4/sp800-63b.html)).

## How do you meet ISM-0421?

1. **List every sign-in that accepts a password or PIN on its own**, using the cases above: computers, phones, on-premises applications, older remote access, network device admin pages, shared accounts, customer portals and scripts.
2. **Put multi-factor authentication in front wherever the system allows it** (ISM-0417), at the point that grants access, with no "remember this computer" and no network or device exemptions. Equipment that cannot do it can sit behind a jump server that does.
3. **Set a 15-character minimum on everything left** (17 and 20 on SECRET and TOP SECRET systems), phone passcodes and start-up PINs included. On Windows, ASD's hardening guide pairs it with the "Relax minimum password length limits" setting, and Microsoft warns that a minimum above 14 "may affect compatibility with clients, services, and applications", so test first ([Microsoft](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-devicelock)).
4. **Change the related settings at the same time.** Block common and breached passwords (ISM-2078), turn off complexity rules (ISM-2080; our [ISM-2080 guide](/ism/ism-2080) explains why), and allow at least 64 characters and every printable character (ISM-2079, ISM-2081). Then test that 14 characters is refused and a long passphrase with spaces is accepted.
5. **Replace existing short passwords.** A new minimum applies when a password is next set, and since December 2025 the ISM no longer asks for time-based changes (ISM-1590), so schedule one change for the accounts that sign in with a password alone.
6. **Make long passwords easy.** Teach passphrases of at least 4 random words, never a real sentence or a quote (ISM-1558; four short words can fall under 15 characters, so both rules apply), and provide an organisation-managed password manager.
7. **Give privileged, break glass and service accounts at least 30 random characters** (ISM-1795) from a tool that generates and stores them; our [ISM-1685 guide](/ism/ism-1685) covers these accounts.
8. **Record what cannot comply** in the exceptions register, with interim protection and a date to fix it, and keep the written password standard in step.

## What evidence shows ISM-0421 is met?

| Ask | Look at | Good looks like |
|---|---|---|
| Which sign-ins rely on a password or PIN alone? | An inventory of systems and how each signs people in | Every one listed, with the reason multi-factor authentication is not possible (ISM-0417) |
| What minimum does each enforce? | Password and PIN settings, and a test change with 14 characters | 15 characters or more (17 or 20 on SECRET or TOP SECRET systems); the test is refused |
| Are older short passwords gone? | Last password change dates against the date the minimum went up | Changed since, or a dated plan |
| Is the second factor on every sign-in? | Multi-factor authentication settings and sign-in logs | No "remember this computer", network or device exemptions; these passwords and unlock PINs at least 6 characters (ISM-1559) |
| Are administrator and service account credentials long and random? | The password manager or privileged access tool | At least 30 random characters (ISM-1795) |
| Does the written standard match? | The password standard and the exceptions register | 15 characters for single-factor sign-in; every exception owned and dated |

## What gets in the way?

**Platforms with built-in limits.** Microsoft documents the password policy for accounts created in Microsoft Entra ID as "A minimum of 8 characters and a maximum of 256 characters" and says, "Unless noted, you can't change these settings" ([Microsoft](https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sspr-policy)). For accounts like these, make sure the password never works alone: multi-factor authentication on every sign-in, with older sign-in methods that bypass it switched off.

**Old devices and applications.** Some accept only short passwords. Put them behind a jump server with multi-factor authentication, limit who can reach them, and list them as exceptions until they are replaced.

**People.** Four or five random words usually clear 15 characters and are easier to type on a phone than a short string of symbols; ASD suggests "a random mix of words, such as unrelated words from the page of a book" ([ASD](https://www.cyber.gov.au/publication/personal-cyber-security-handbook/use-unique-and-strong-passwords-where-the-use-of-passkeys-is-unavailable)). Phone passcodes are the bigger change, so explain them first.

**Customer-facing services.** A long minimum adds friction at sign-up. Passkeys or multi-factor authentication take customers out of single-factor sign-in, and ISM-1892 asks for multi-factor authentication where an online customer service holds sensitive customer data.

**Smaller and larger organisations.** A smaller organisation with multi-factor authentication already on its cloud accounts is left with computer sign-ins, phones, local accounts and a few applications. A larger one faces several directories, legacy applications and service accounts: an inventory and a change programme.

**The business case.** The setting costs little; testing, help desk calls and replacing what cannot comply cost more. In return, a copied password list becomes much harder to turn into working sign-ins.

## What tools and skills help?

- **An identity platform or directory** that enforces a 15-character minimum, checks new passwords against common and breached ones, and reports which sign-ins still accept a password alone.
- **Multi-factor authentication and passkeys**, which take the password out of single-factor sign-in altogether.
- **Device management** that sets phone passcodes, start-up PINs and sign-in PINs to the right length.
- **A password manager.** ASD says one "helps you create, manage and store your passwords and passkeys in one secure place" ([ASD](https://www.cyber.gov.au/publication/personal-cyber-security-handbook/use-unique-and-strong-passwords-where-the-use-of-passkeys-is-unavailable)).
- **The skills** to find every place a password works alone, test a longer minimum without locking people out, and explain the change.

Which of your current licences already provide these? The [free coverage check](https://check.teresec.com.au/?utm_source=teresec.com.au&utm_medium=ism-guide&utm_campaign=ism-0421) shows which ISM and Essential Eight controls the products you already pay for can reach, in about three minutes. To see ISM-0421 beside the other password controls, open it in our [sample coverage report](/sample-report.html#ISM-0421), or read [what an ISM assessment involves](/services/ism).

## What changed in recent ISM releases?

ISM-0421 is at revision 11, last updated in December 2025. ASD's December 2025 change report says the earlier version recommended that "passphrases used for single-factor authentication on non-classified, OFFICIAL: Sensitive and PROTECTED systems are at least 4 random words with a total minimum length of 15 characters", and that it "was amended to move the reference to 4 random words to ISM-1558". The same release replaced "passphrases" with "passwords" across the password controls "to align with preferred language under the finalised NIST SP 800-63B-4 publication" ([ASD](https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/ism/archived-ism-releases)). In September 2026 ISM-0421 moved to "Guidelines for system access › Credential management", wording unchanged ([ASD](https://www.cyber.gov.au/sites/default/files/2026-08/ISM%20September%202026%20changes%20%28September%202026%29.pdf)); our [ISM September 2026 summary](/blog/2026-09-17-ism-september-2026-update) covers the rest.

## Sources

- ASD, [Information security manual](https://www.cyber.gov.au/ism): ISM-0421, and the guidance and terminology quoted on this page
- ASD, [Implementing multi-factor authentication](https://www.cyber.gov.au/publication/implementing-multi-factor-authentication) (November 2023)
- ASD, [Hardening Microsoft Windows 11 workstations](https://www.cyber.gov.au/business-government/protecting-devices-systems/hardening-systems-applications/system-hardening/hardening-microsoft-windows-11-workstations): password, sign-in PIN and drive encryption settings
- ASD, Blueprint for Secure Cloud: [Securing iOS devices](https://blueprint.asd.gov.au/design/endpoints/ios/security/securing-ios-devices/)
- ASD, [Archived ISM releases](https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/ism/archived-ism-releases): the December 2025 release and its "ISM December 2025 changes" report
- ASD, [ISM September 2026 changes](https://www.cyber.gov.au/sites/default/files/2026-08/ISM%20September%202026%20changes%20%28September%202026%29.pdf)
- ASD, Personal cyber security handbook: [Use unique and strong passwords (where the use of passkeys is unavailable)](https://www.cyber.gov.au/publication/personal-cyber-security-handbook/use-unique-and-strong-passwords-where-the-use-of-passkeys-is-unavailable)
- NIST, [SP 800-63B-4](https://pages.nist.gov/800-63-4/sp800-63b.html): password verifiers and activation secrets
- Microsoft, [DeviceLock Policy CSP](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-devicelock) and [Self-service password reset policies](https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sspr-policy)