ISM-2141 says that when software signs in to other systems by itself, it should use credentials that are issued on demand and expire quickly, in preference to passwords, API keys and access keys that work until someone changes them. Where a fixed credential cannot be avoided, the controls beside it keep it in a secrets management solution (ISM-2142), unique to one application and environment (ISM-2143), changed when it leaks (ISM-2144) and revoked when nothing needs it (ISM-2146). All five are new in the September 2026 Information Security Manual.
In plain English:
ASD sets no maximum lifetime. Our reading: minutes or hours, not months, so a copy stolen today is useless tomorrow. GitHub's tokens for build pipelines, for example, are "only valid for a single job" (GitHub).
ASD's credential management guidance applies to every kind of account, "service accounts" included, and to "non-interactive authentication". ISM-2141 applies at every classification ASD marks, from non-classified systems to TOP SECRET, and is not part of the Essential Eight.
ASD gives the reason beside the control: "Where such credentials are long-lived or reused by multiple applications, workloads or operating environments, their compromise can provide malicious actors with persistent access to systems and increase the extent of a compromise." Two public cases show how.
Static secrets get copied. In March 2025 a third-party step for GitHub build pipelines, tj-actions/changed-files, was compromised. CISA reported that the compromise "allows for information disclosure of secrets including, but not limited to, valid access keys, GitHub Personal Access Tokens (PATs), npm tokens, and private RSA keys", which attackers could find by reading the pipelines' logs, and advised: "Rotate all identified secrets immediately as they should be considered compromised" (CISA). A long-lived key printed in a log works for whoever finds it until it is changed; a token that expired with the job is worth little by the time anyone reads the log.
Static secrets get forgotten. Cloudflare reported that on 23 November 2023 it found an attacker on its self-hosted Atlassian server, who had got in "by using one access token and three service account credentials that had been taken, and that we failed to rotate, after the Okta compromise of October 2023". They "were not rotated because mistakenly it was believed they were unused", and Cloudflare went on to rotate "every production credential (more than 5,000 individual credentials)" (Cloudflare). Every static credential is one more to find and change after an incident, and the forgotten ones are the ones that get used.
The controls around ISM-2141 handle the static credentials that remain:
AI agents that call other systems are workloads too (see our ISM-2156 guide).
Most platforms now let software prove what it is and receive a credential that expires. The option depends on where the software runs:
Where none of these is possible, the credential stays static under ISM-2142 to ISM-2146.
| Ask | Look at | Good looks like |
|---|---|---|
| Which applications and workloads sign in to other systems? | The inventory of non-human credentials | Every credential listed with owner, purpose, type, location and last use |
| Do cloud workloads use the platform's own identity? | Cloud identity settings; the list of access keys and client secrets | Managed identities or roles in use; few long-lived keys, each with a recorded exception |
| Do build pipelines hold cloud secrets? | Pipeline secrets and variables | Deployments use short-lived tokens through federation; no stored cloud keys |
| How long do issued credentials last? | Token, certificate and lease settings | Minutes or hours, renewed automatically |
| Where do the remaining static credentials live? | The secrets management solution (ISM-2142) | All of them there; none in code, configuration files or pipeline settings |
| Are any shared? | Credentials per application and environment (ISM-2143) | One each; no production credential in test |
| What happens when one leaks or is no longer needed? | Change and revocation records (ISM-2144, ISM-2146) | Changed promptly after each finding; revoked when an application is retired |
Software that only accepts a password or key. Older applications, network appliances and many cloud service APIs take only a fixed key, and AWS itself lists cases that still need long-term keys, such as "WordPress plugins" (AWS). Keep those under ISM-2142 to ISM-2146, record the exception, and ask the supplier about short-lived options at each renewal.
Fear of breaking production. Changing a static credential by hand is where outages happen. Cloudflare reported that on 21 March 2025, while rotating a service's credentials, its team "inadvertently deployed the new credentials (ID and key pair) to a development instance of the service instead of production", and services saw errors for "1 hour and 7 minutes" (Cloudflare). Short-lived credentials remove that manual step. For static ones, automate the change and confirm the new credential is in use before removing the old, as Cloudflare now requires.
Nobody knows what is out there. Keys made by former staff, contractors and integrators for projects long finished, and new ones made because setup guides often start with a pasted key. The inventory is most of the work, and ISM-2146 needs it too.
Smaller and larger organisations. A smaller organisation usually has a handful of integrations between cloud services: apps registered in its identity platform with a client secret, the backup service, the website's deployment, the accounting system's connections. Its IT provider and suppliers can say which use fixed keys, and the platforms' own identity features are often part of what it already pays for. A larger one has hundreds of applications across several clouds, container platforms and pipelines, and needs a platform team, one standard way for workloads to prove their identity, policies that block new long-lived keys, and owners for every exception.
The business case. The costs are engineering time to change how software signs in and, for some, a secrets management licence. What it buys is fewer secrets to steal, fewer to change after a leak, and a smaller clean-up: Cloudflare's response to four missed credentials was to rotate more than 5,000.
Which of the products you already pay for help here? The free coverage check shows which ISM and Essential Eight controls your current products can reach, in about three minutes. To see ISM-2141 among the other credential controls, open it in our sample coverage report, or read what an ISM assessment involves.
ISM-2141 is new: ASD added it in the September 2026 release, at revision 0, with ISM-2142 and ISM-2143, the three controls in the new subsection "Application and workload credentials" of the system access guidelines (ASD). The same release added ISM-2144 under "Changing credentials" and ISM-2145 and ISM-2146 under "Revoking credentials", and moved the existing credential controls, ISM-1619 among them, into the new credential management section. Our ISM September 2026 summary covers the rest.