Essential Eight RA-ML3.5 Local Security Authority protection functionality is enabled
What it says
Local Security Authority protection functionality is enabled.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure LSA protection is on to prevent malware from stealing credentials.
Local Security Authority (LSA) protection helps keep your computer safe by stopping sneaky programs from stealing important information like passwords. Without this protection, malware could grab your credentials and gain access to your systems, leading to data breaches or unauthorised access.
Free. Save your status, tasks and notes.
Why it matters
Without LSA protection, attackers can dump LSASS to steal credential material, enabling account takeover and unauthorised access.
How to implement
System administrator should enable LSA protection on all computers to increase security.
They can do this via group policy settings in Windows by accessing the security settings and ticking the box for LSA protection.
IT team should regularly check that LSA protection settings are applied across all systems.
They can do this by running a regular script that checks the status of LSA settings and reports back on compliance.
Security officer should educate staff on why LSA protection is crucial.
They can do this through brief training sessions or newsletters explaining the risk of credential theft and the benefits of protection measures.
System administrator should configure automatic updates for systems to ensure LSA protection features are up-to-date.
This can be done by enabling Windows Update on all machines so that the latest security improvements are applied promptly.
Keep it running
Enforce LSA protection via GPO/Intune, verify it remains enabled after patching, and monitor Windows events for attempts to disable RunAsPPL.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
Is LSA protection enabled on all systems within the organisation?
Look at
Request the system configuration or policy documentation that shows LSA protection settings.
Good evidence
The settings should show LSA protection is enabled on every computer, verified by both policy documentation and system checks.
- Check 2 of 2What an auditor asks for
Ask for
How often are LSA settings reviewed for compliance?
Look at
Inspect logs or reports verifying regular checks of LSA settings across systems.
Good evidence
Scheduled reports from system checks should show consistent review intervals, with all systems marked compliant.
Mappings
Closest match in ASD Information Security Manual: ISM-1861, Enable Local Security Authority protection, which asks for the same thing.
ASD Information Security Manual: 4 mappings
This control is equivalent to ISM-1861.
E8-RA-ML3.5 requires Local Security Authority (LSA) protection functionality to be enabled to harden credential handling and reduce credential theft. ISM-1861 mandates enabling LSA protection with the same intent and technical outcome. Both controls are effectively the same requirement expressed in different frameworks, with no material difference in scope or depth.
This control partially meets ISM-1858.
ISM-1858 requires IT equipment to be hardened using ASD and vendor hardening guidance, applying the most restrictive guidance where conflicts occur. E8-RA-ML3.5 mandates enabling Local Security Authority (LSA) protection, which is a specific hardening configuration on Windows endpoints. This makes the candidate a specific subset implementation that would sit under the broader hardening expectations of ISM-1858.
This control partially overlaps ISM-1492.
ISM-1492 requires operating system exploit protection functionality to be enabled to block or reduce common exploitation behaviours. E8-RA-ML3.5 requires Local Security Authority (LSA) protection, which hardens a specific OS authentication component against tampering and credential dumping. The common ground is OS hardening that frustrates attacker activity, but ISM-1492 is aimed at exploit protection broadly while E8-RA-ML3.5 is a targeted control for protecting the LSA process.
This control partially overlaps ISM-1686.
ISM-1686 requires Credential Guard functionality to be enabled to better protect credentials in Windows environments. E8-RA-ML3.5 requires Local Security Authority (LSA) protection to be enabled, which also hardens credential-handling processes and reduces credential theft risk. The controls overlap in their goal of protecting credentials in memory, but they are distinct Windows security features and enabling one does not automatically enable the other.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-04.1Define approved hardening baselines disabling unneeded services, insecure settings and weak protocolsPartially overlaps
This control partially overlaps IT.PRO-04.1.
IT.PRO-04.1 requires approved configuration baselines that disable or remove unnecessary services, insecure settings and weak protocols; E8-RA-ML3.5 requires Local Security Authority protection functionality to be enabled, a hardening setting such a baseline would include.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.