ISM-1593 says a person gives enough evidence of who they are before they receive their first credentials, and again whenever they ask for a password or multi-factor authentication (MFA) method to be reset, switched off for a while, or set up on a new device. It closes a common route around strong sign-in: an attacker who cannot beat MFA calls the service desk, poses as an employee and asks for a reset. Since the September 2026 Information Security Manual it applies to all four kinds of request, not only new credentials, and it works with ISM-2148, which ends the account's existing sessions after any reset.
A credential is anything a person signs in with: a password or PIN, an authenticator app, a phone number that receives codes, a passkey, a security key or a smart card. ISM-1593 names four moments when the person asking must "provide sufficient evidence to verify their identity":
The control says "human users", which the ISM defines as "A human actor who is authorised to access a system and its resources." Service accounts and AI agents have their own controls (see our guides to ISM-1685 and ISM-2156).
ASD does not set a level of evidence. Its guidance gives examples: "physically presenting themselves and their pass to a service desk, answering a set of challenge-response questions, or by demonstrating control of a linked mobile device." Our reading: evidence is sufficient when someone who has researched the employee still could not provide it, the bar rises with what the account can reach, and the control applies to every channel requests arrive through, including an outsourced service desk and self-service reset pages.
ISM-1593 applies at every classification ASD marks, from non-classified systems to TOP SECRET, and is not part of the Essential Eight.
MFA protects sign-in, but the process that issues and replaces it can be talked around. ASD's Annual Cyber Threat Report 2025-26 describes how the Scattered Spider group does it: "The social engineering attempts are designed to first learn what steps are needed to conduct password resets from helpdesks." Then: "Finally, the threat actors conduct spearphishing calls to convince IT help desk personnel to reset passwords and/or transfer multi-factor authentication tokens."
ASD's joint advisory with partner agencies says "Scattered Spider is a cybercriminal group that targets large companies and their contracted information technology (IT) help desks" (ASD). Note "contracted": an outsourced service desk is part of your defences.
After the 2025 attacks on United Kingdom retailers, the UK's National Cyber Security Centre recommended that organisations "review helpdesk password reset processes, including how the helpdesk authenticates staff members credentials before resetting passwords, especially those with escalated privileges" (NCSC). In 2023 Okta reported callers trying "to convince service desk personnel to reset all Multi-factor Authentication (MFA) factors enrolled by highly privileged users" (Okta).
Self-service is no safe harbour. In July 2026 Okta Threat Intelligence reported "a growing number of attacks in which users are tricked into approving attacker-initiated MFA enrollments and password resets" (Okta).
The facts a service desk usually checks are what an attacker collects first. ASD's report says the calls aim "to gather password reset specific information of a targeted employee", and "are enriched by access to personal information derived from social media, open-source information, commercial intelligence tools, and database leaks". An employee number, a manager's name or a date of birth is not a secret.
NIST's identity guideline goes further than ASD's examples: "Knowledge-based verification (KBV) or knowledge-based authentication SHALL NOT be used for identity verification" (NIST). Our reading: ASD's challenge-response questions can be one part of a check, never the whole check, and only with answers nobody can look up.
Evidence that holds up, roughly strongest first:
A phone number alone is weak: the joint advisory describes attackers persuading mobile carriers to move a target's number to their own SIM card. Hold privileged accounts to the strongest checks: in person, or two independent checks from the list, never a phone call alone. A voice on the phone is a claim, not evidence.
The controls beside ISM-1593 say what happens once identity is verified:
Two more finish the job:
| Ask | Look at | Good looks like |
|---|---|---|
| Is there a written standard? | The verification procedure | Covers all four kinds of request for each level of account, and lists what never counts |
| Does every channel follow it? | The list of channels and the outsourced desk's contract | Every channel, self-service included, follows the standard |
| Were recent requests verified? | A sample of last month's tickets | Each records the evidence checked and who approved |
| Do administrators face a higher bar? | Tickets for privileged account resets | In person or two independent checks; no phone-only resets |
| Is self-service hard to abuse? | Self-service reset and MFA registration settings | An existing strong factor or a code issued after verification |
| What happens after a reset? | Audit logs and notification settings (ISM-2148, ISM-2047) | Sessions revoked and the person notified through a second channel |
| Has it been tested? | Results of test calls | A caller with researched details was refused |
Helpfulness and speed. Service desks exist to get people working, and attackers use that: urgency, a senior title, a flight about to leave. A desk measured only on call time will cut corners, so back the staff who refuse.
Remote staff. In person is often impossible. Combine a video call with photo ID, the manager's confirmation and a prompt to a registered device where one survives.
The outsourced desk. You cannot listen to another organisation's calls. Write the standard into the contract, ask for the records, and test it.
Smaller and larger organisations. In a smaller organisation people know each other, which helps, but recognising a voice is not evidence, and its IT provider handles resets for many clients and needs a method agreed with each. A larger one has more channels and desks, and needs verification tooling and regular test calls.
The business case. The cost is a few minutes per reset, some friction, and registering a second MFA method for everyone, which also means fewer lost-phone calls. What it buys is closing a route that ASD and the UK's National Cyber Security Centre both describe attackers using.
Which of the products you already pay for help here? The free coverage check shows which ISM and Essential Eight controls your current products can reach, in about three minutes. To see ISM-1593 among the other credential controls, open it in our sample coverage report, or read what an ISM assessment involves.
ISM-1593 was rewritten in the September 2026 release (now revision 2). It used to say "Users provide sufficient evidence to verify their identity when requesting new credentials." ASD's change report says it "was amended to capture when first requesting credentials, when requesting the reset of any credentials, when requesting the temporary disabling of any credentials, and when requesting the enrolment or re-enrolment of any credentials" (ASD). The same release moved it, with ISM-1227, ISM-1594 and ISM-1595, from "Guidelines for system hardening › Authentication hardening" to "Guidelines for system access › Credential management"; changed "users" to "human users" in these and other controls, ISM-2047 included; and added ISM-2148. Our ISM September 2026 summary covers the rest.