PRO-13 · Protect

Identity, credential and access management

Robust and secure identity, credential and access management is used to establish, maintain and control access to systems (infrastructure, operating systems, applications and data) and to support effective detection of identity and credential misuse.

Enterprise IT actions

• IT.PRO-13.1

  Identify and disable or remove default and unused accounts regularly, permitting exceptions only where the account is documented, justified, hardened and monitored.

  • Phase 1Boundary services, Identity services
  • Phase 2Critical processes and services, Privileged environments
  • Phase 3Business systems, User devices
  ASD’s indicators

  Not effective

  • No review of default or unused accounts has been conducted within the review period defined by the organisation.
  • Default vendor accounts remain enabled on production systems without appropriate documentation, justification, hardening and monitoring in place for their use.
  • No process exists to identify accounts that have not authenticated within a defined period.

  Partially effective

  • A review has been conducted but does not cover all assets.
  • Default accounts have been identified but some remain enabled without documented justification.
  • Unused accounts are identified but remediation is incomplete or delayed beyond defined timeframes.

  Fully effective

  • A review of accounts has been completed within the defined review period covering all assets.
  • Default accounts are disabled or have approved justification for remaining active, with appropriate monitoring and compensating controls for their use in place.
  • Accounts that show no evidence of use, other than approved emergency access accounts, are identified and either disabled or removed in accordance with defined timeframes.
  Related frameworks

  ISM

  ISM-0380, ISM-0383, ISM-1260

  NIST CSF 2.0

  PR.AA-01, PR.AA-05

  NIST SP 800-171r3

  03.01.01, 03.05.12

  AESCSF v2

  ACCESS-1c, ACCESS-1f, ACCESS-1j, ACCESS-1e

  Essential Eight

  Restrict administrative privileges

  MITRE ATT&CK

  T1078 Valid Accounts, T1110 Brute Force

  Rate this action in the Navigator →
• IT.PRO-13.2

  Store authentication keys, secrets and tokens in approved secure repositories with access controls, including MFA.

  • Phase 1Boundary services, Identity services
  • Phase 2Critical processes and services, Privileged environments
  • Phase 3Business systems
  ASD’s indicators

  Not effective

  • Credentials are stored in plaintext, spreadsheets, shared drives or other unapproved locations as standard practice.
  • No approved secure repository is in use to store authentication keys, secrets and tokens.
  • Access to credential stores is neither controlled nor audited.
  • Access controls such as MFA are not enabled for authentication to secure repositories.

  Partially effective

  • An approved secure repository is in use but does not cover all authentication keys, secrets and tokens within scope.
  • Access controls for secure repositories are in place but access logging is not enabled or not reviewed.
  • MFA is enforced for some, but not all, applicable users, repositories or authentication pathways, and the remaining exceptions are documented and subject to remediation.

  Fully effective

  • Authentication keys, secrets and tokens within scope are stored in approved secure repositories, with any authorised exceptions documented, risk-assessed and managed in accordance with organisationally defined requirements.
  • Access to secure repositories is restricted using attribute or role-based access controls, MFA is enforced for all applicable authentication pathways, and access is logged and reviewed and investigated where necessary.
  Related frameworks

  ISM

  ISM-1402, ISM-1957

  NIST CSF 2.0

  PR.AA-01, PR.AA-02, PR.DS-01, PR.DS-02

  NIST SP 800-171r3

  03.05.12, 03.13.10, 03.05.03, 03.13.08

  AESCSF v2

  ACCESS-1b, ARCHITECTURE-5e, ACCESS-1h, ARCHITECTURE-5a

  Essential Eight

  Multi-factor authentication

  MITRE ATT&CK

  T1552 Unsecured Credentials, T1555 Credentials from Password Stores

  Rate this action in the Navigator →
• IT.PRO-13.3

  Identify and remediate unsecured keys, secrets and credentials by regularly scanning codebases, configuration files, file shares and user collaboration platforms.

  • Every phaseVisibility and response
  ASD’s indicators

  Not effective

  • No secret scanning capability is deployed.
  • No process exists to identify credentials exposed in codebases, configuration files, file shares or user collaboration platforms.
  • Unsecured keys, secrets and credentials found exposed in codebases, configuration files, scripts, file shares or user collaboration platforms are left in place with no action taken.

  Partially effective

  • Secret scanning is deployed but does not cover all repositories, pipelines or user collaboration platforms.
  • Scanning runs but discovered credentials are not assessed in a timely manner.
  • Unsecured keys, secrets and credentials that are discovered are assessed, but are not rotated or revoked in a timely manner.

  Fully effective

  • Secret scanning tooling is deployed across codebases, configuration files, file shares and user collaboration platforms.
  • Scans to identify unsecured keys, secrets and credentials run on a regular schedule defined by the organisation.
  • Unsecured keys, secrets and credentials that are discovered are assessed, then rotated and/or revoked within timeframes defined by the organisation.
  Related frameworks

  ISM

  ISM-1402, ISM-1875, ISM-2030

  NIST CSF 2.0

  PR.AA-01, ID.RA-01, DE.CM-09

  NIST SP 800-171r3

  03.05.12, 03.11.02, 03.05.07

  AESCSF v2

  ACCESS-1b, THREAT-1c, ARCHITECTURE-5a

  MITRE ATT&CK

  T1078 Valid Accounts, T1552 Unsecured Credentials

  Rate this action in the Navigator →
• IT.PRO-13.4

  Use phishing-resistant MFA for users authenticating to systems, including from untrusted, external or high-risk locations.

  • Phase 1Boundary services, Identity services
  • Phase 2Critical processes and services, Privileged environments
  • Phase 3Business systems, User devices
  ASD’s indicators

  Not effective

  • Phishing-resistant MFA is not enforced for interactive user authentication to systems.
  • MFA is deployed but uses non-phishing-resistant methods, such as SMS, voice, or push-only authentication instead of phishing-resistant MFA.
  • No access policies differentiate between trusted and untrusted, external or high-risk locations.
  • Access from untrusted, external or high-risk locations is permitted without MFA, or with non-phishing-resistant MFA.

  Partially effective

  • Phishing-resistant MFA is deployed for some but not all systems within scope.
  • Access policies exist but do not cover all organisationally defined high-risk location categories.
  • Exceptions or alternative authentication pathways allow routine or recurring authentication without phishing-resistant MFA, or emergency access arrangements are not adequately restricted, monitored, tested or reviewed.

  Fully effective

  • Phishing-resistant MFA is enforced for all routine interactive user authentication to systems within scope.
  • Phishing-resistant MFA is enforced for routine authentication attempts from untrusted, external or high-risk locations.
  • Customer-facing services provide a phishing-resistant MFA option for authentication.
  • Emergency access arrangements are periodically tested and reviewed to confirm that they remain operational, appropriately protected and limited to their intended purpose. Credentials or authentication factors used for emergency access are securely managed and are not used for routine administration.
  Related frameworks

  NIST CSF 2.0

  PR.AA-01, PR.AA-02, PR.AA-03, PR.AA-05

  NIST SP 800-171r3

  03.05.03, 03.05.04, 03.01.12

  AESCSF v2

  ACCESS-1h, ACCESS-1i, ACCESS-2g

  Essential Eight

  Multi-factor authentication

  MITRE ATT&CK

  T1078 Valid Accounts, T1098 Account Manipulation, T1110 Brute Force, T1021 Remote Services, T1621 Multi-Factor Authentication Request Generation, T1557 Adversary-in-the-Middle

  Rate this action in the Navigator →
• IT.PRO-13.5

  Disable legacy authentication protocols or, where this is not feasible, restrict and monitor their use, apply compensating controls and establish a time-bound decommissioning plan.

  • Phase 1Boundary services, Identity services
  • Phase 2Critical processes and services, Privileged environments
  • Phase 3Business systems, User devices
  ASD’s indicators

  Not effective

  • Legacy authentication protocols that cannot enforce modern authentication controls remain enabled and in active use without restriction.
  • No assessment has been conducted to identify which legacy authentication protocols are in use within the environment.
  • Authentication mechanisms transmitting credentials in cleartext or using weak cryptographic primitives remain enabled and no action has been taken to disable them.
  • Where legacy protocols are retained, no compensating controls, no monitoring and no decommissioning timelines are in place.

  Partially effective

  • Legacy authentication protocols have been identified and are partially restricted but some remain enabled across systems within scope without justification.
  • An assessment has been conducted but does not cover all in-scope systems, or the inventory of legacy protocols in use is not maintained.
  • Some weak authentication mechanisms have been disabled but others remain enabled without documented justification or remediation plan.
  • Compensating controls exist for some retained legacy protocols but monitoring is inconsistent or decommissioning timelines are not defined.

  Fully effective

  • Legacy authentication protocols that cannot enforce modern authentication controls have been identified and disabled across systems within scope, excluding documented and risk accepted exceptions.
  • An assessment of legacy authentication protocol use has been conducted across in-scope systems and the inventory is maintained.
  • Where retention is necessary, compensating controls are applied and decommissioning timelines are recorded and tracked.
  • Ongoing use of legacy authentication protocols is regularly risk reviewed, accepted and recorded in the organisation's risk register.
  Related frameworks

  ISM

  ISM-0380, ISM-1055, ISM-1603

  NIST CSF 2.0

  PR.AA-03, PR.PS-01, PR.IR-01

  NIST SP 800-171r3

  03.05.04, 03.04.06

  AESCSF v2

  ARCHITECTURE-3d, ASSET-3a

  MITRE ATT&CK

  T1110 Brute Force, T1078 Valid Accounts, T1557 Adversary-in-the-Middle

  Rate this action in the Navigator →
• IT.PRO-13.6

  Ensure that user, machine, system and service account credentials are unique per system or account, particularly in high-privilege contexts.

  • Phase 1Boundary services, Identity services
  • Phase 2Critical processes and services, Privileged environments
  • Phase 3Business systems, User devices
  ASD’s indicators

  Not effective

  • Local administrator credentials are shared across the device fleet, or service or privileged account credentials are routinely reused across systems.
  • Credential uniqueness is not enforced for applicable user, machine, system or service identities.
  • Credential uniqueness has not been addressed in high-privilege contexts, including domain administration, cloud administration or automation platforms.
  • Where credential uniqueness cannot be enforced, neither compensating controls nor remediation paths are in place.

  Partially effective

  • Local administrator credential uniqueness has been implemented for some device populations but coverage is incomplete across the device fleet.
  • A technical mechanism is in place but applies to only a subset of credential types or systems within scope.
  • Credential uniqueness has been addressed in some high-privilege contexts but gaps remain in others.
  • Compensating controls exist for some shared credentials but monitoring is inconsistent or remediation plans do not exist.

  Fully effective

  • Credentials for applicable local administrative accounts are unique to each system or account.
  • Credential uniqueness is consistently enforced for applicable user, machine, system and service identities.
  • Credential uniqueness is enforced consistently in high-privilege contexts, with managed identities or equivalent capabilities used in preference to shared static credentials wherever feasible.
  • Where uniqueness cannot be enforced, compensating controls are applied, the use of the shared credentials is monitored, and a remediation plan exists.
  Related frameworks

  ISM

  ISM-1227, ISM-1596, ISM-1953

  NIST CSF 2.0

  PR.AA-01, PR.AA-03, PR.AA-05

  NIST SP 800-171r3

  03.05.01, 03.05.05, 03.05.12

  AESCSF v2

  ACCESS-1b, ACCESS-1g, ACCESS-1d

  Essential Eight

  Restrict administrative privileges

  MITRE ATT&CK

  T1110 Brute Force, T1078 Valid Accounts

  Rate this action in the Navigator →

Operational technology actions

• Action 1

  Confirm the functionality of break-glass accounts, and the availability of their secrets, for administrative access during isolation from other authentication mechanisms.

  • Phase 2Identity services
  Rate this action in the Navigator →
• Action 2

  Use phishing-resistant MFA for users authenticating across a perimeter into OT, and from any network not under the organisation's sole OT administrative control.

  • Phase 1Boundary services
  • Phase 2Identity services
  Rate this action in the Navigator →
• Action 3

  Ensure that credentials are unique per device or account, changing default, supplier and simple passwords before a device is commissioned or replaced, and where unique credentials are not supported, apply a compensating control that protects the device.

  • Phase 1Boundary services, Critical processes and services
  • Phase 2Privileged environments, Identity services
  • Phase 3Business systems
  Rate this action in the Navigator →

Cloud actions

• Action 1

  Regularly scan codebases, configuration files, file shares and user collaboration platforms to identify unsecured keys, secrets credentials and tokens

  • Every phaseVisibility and response
  • ResponsibilityPaaS: Supplied, SaaS: Supplied
  Rate this action in the Navigator →
• Action 2

  Identify and disable or remove default and unused accounts on a regular basis, permitting exceptions only where the account is documented, justified, hardened and monitored. Govern emergency access accounts separately, minimise their number, securely protect their credentials, monitor their use and test them regularly.

  • Phase 1Identity services, Boundary services
  • Phase 2Critical processes and services, Privileged environments
  • Phase 3Business systems, User devices
  • ResponsibilityPaaS: Supplied, SaaS: Supplied
  Rate this action in the Navigator →
• Action 3

  Monitor services for supply chain compromise, including provider advisories and changes to security commitments, and respond in a timely manner.

  • Phase 1Identity services, Boundary services
  • Phase 2Critical processes and services, Privileged environments
  • Phase 3Business systems, User devices
  • ResponsibilityPaaS: Supplied, SaaS: Supplied
  Rate this action in the Navigator →
• Action 4

  Store credentials, keys, secrets and tokens in approved secure access controlled repositories, and rotate, expire or replace non-person credentials with managed or federated workload identities where supported..

  • Phase 1Identity services
  • ResponsibilityPaaS: Supplied, SaaS: Supplied
  Rate this action in the Navigator →
• Action 5

  Use phishing-resistant MFA for users authenticating to systems.

  • Phase 1Identity services, Boundary services
  • Phase 2Critical processes and services, Privileged environments
  • Phase 3Business systems, User devices
  • ResponsibilityPaaS: Supplied, SaaS: Supplied
  Rate this action in the Navigator →
• Action 6

  Non-person identities are authorised, assigned an owner and constrained to their intended context, with use bound to trusted workload, issuer or service conditions and activity recorded.

  • Phase 1Identity services, Boundary services
  • Phase 2Critical processes and services, Privileged environments
  • Phase 3Business systems
  • ResponsibilityPaaS: Supplied, SaaS: Supplied
  Rate this action in the Navigator →
• Action 7

  Disable legacy authentication protocols or, where this is not feasible, restrict and monitor their use, apply compensating controls and establish a time-bound decommissioning plan.

  • Phase 1Identity services, Boundary services
  • Phase 2Critical processes and services, Privileged environments
  • Phase 3Business systems, User devices
  • ResponsibilityPaaS: Supplied, SaaS: Supplied
  Rate this action in the Navigator →
• Action 8

  Ensure that user and non-person credentials are unique per system or account, particularly in high-privilege contexts.

  • Phase 1Identity services, Boundary services
  • Phase 2Critical processes and services, Privileged environments
  • Phase 3Business systems, User devices
  • ResponsibilityPaaS: Customer, SaaS: Customer
  Rate this action in the Navigator →

Open the Navigator →

More Protect principles

• PRO-01Secure system lifecycle
• PRO-04Secure configuration management
• PRO-05Secure administration
• PRO-06Vulnerability management
• PRO-07Trustworthy software
• PRO-08Cryptographic protection
• PRO-09Content filtering
• PRO-10Regular and proven backups
• PRO-12Least privilege access
• PRO-14Cyber security awareness training
• PRO-15Physical access control
• PRO-16Cyber supply chain security
• PRO-18Network segmentation and segregation
• PRO-19Operational technology isolation
• PRO-20Remote access to operational technology

Source: ASD Essentials for enterprise IT, version 2026.10.15; ASD Essentials for operational technology, version 2026.10.15; ASD Essentials for cloud, version 2026.10.15, Australian Signals Directorate. The Navigator is an independent project and is not affiliated with or endorsed by the Australian Signals Directorate.