Essential Eight RA-ML3.6 Enable Credential Guard for secure credential storage
What it says
Credential Guard functionality is enabled.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnable Credential Guard to protect credentials from attacks by isolating them.
Enabling Credential Guard is like putting your most sensitive keys in a safe. It prevents cybercriminals from stealing login details by keeping them securely isolated. Without it, attackers could access sensitive areas of your system, leading to data theft or system damage.
Free. Save your status, tasks and notes.
Why it matters
Without Credential Guard, attackers can steal credentials from memory, enabling unauthorised access to critical systems and increasing breach risk.
How to implement
System administrators should enable Credential Guard on all computers.
They can do this by configuring the Group Policy settings for Windows Defender Credential Guard.
IT teams need to verify that each workstation is compatible with Credential Guard.
Check the system requirements and ensure any necessary updates are in place.
The security officer should work with IT to confirm that Credential Guard is included in the organisation's security policy.
They can do this by updating documentation and communicating the change to all staff.
System administrators should regularly monitor the status of Credential Guard to ensure it remains enabled.
Use tools provided in Windows Device Management to check these settings.
Keep it running
Regularly confirm Credential Guard is enabled and running (e.g., via Device Guard/Credential Guard status), as updates or configuration changes can disable it.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
How does the organisation ensure Credential Guard is enabled on all systems?
Look at
Examine the Group Policy configurations and settings in the Windows Management Instrumentation (WMI).
Good evidence
Credential Guard is enabled via Group Policy, and its status is regularly audited and documented.
- Check 2 of 2What an auditor asks for
Ask for
How does the organisation verify workstation compatibility with Credential Guard?
Look at
Check for documentation on system requirements and any setup logs.
Good evidence
The organisation has documented compatibility checks and update procedures for Credential Guard across all systems.
Mappings
Closest match in ASD Information Security Manual: ISM-1686, Enable Credential Guard for credential protection, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.1.
E8-RA-ML3.6 requires a specific endpoint hardening measure: enabling Credential Guard for secure credential storage. ISO/IEC 27001:2022 Annex A 8.1 requires protection of information stored on, processed by, or accessible via user endpoint devices, which is a broader outcome-based control. Enabling Credential Guard is one concrete technical implementation that helps satisfy Annex A 8.1 for the subset of endpoint information that is credential material.
ASD Information Security Manual: 6 mappings
This control is equivalent to ISM-1686.
ISM-1686 requires Credential Guard functionality to be enabled to protect user credentials from unauthorised access. E8-RA-ML3.6 states the same requirement to enable Credential Guard for secure credential storage. Both controls are aligned in scope and intent, with no material difference in depth beyond framework context.
This control partially overlaps ISM-1402.
ISM-1402 requires credentials stored on systems to be protected using mechanisms such as password managers, hardware security modules, or salted/hashed/stretched storage. E8-RA-ML3.6 strengthens this outcome by enabling Windows Credential Guard to better protect cached and stored credentials from theft on endpoints. E8-RA-ML3.6 is platform-specific and focused on OS credential isolation, while ISM-1402 also covers secure storage within applications and databases.
This control partially overlaps ISM-1492.
ISM-1492 requires operating system exploit protection functionality to be enabled to reduce successful exploitation paths. E8-RA-ML3.6 focuses on enabling Credential Guard, which uses OS virtualisation-based security to protect credentials from post-exploitation theft. Both are OS security hardening features that impede attacker techniques, but E8-RA-ML3.6 is credential-theft specific whereas ISM-1492 targets exploit protection more generally.
This control partially overlaps ISM-1861.
ISM-1861 requires LSA protection to be enabled to harden the Local Security Authority process and reduce exposure of authentication secrets. E8-RA-ML3.6 requires Credential Guard, which isolates and protects credentials using virtualisation-based security and complements LSA protection against credential dumping. While both reduce credential theft, E8-RA-ML3.6 focuses on VBS isolation rather than the specific LSA protection setting mandated by ISM-1861.
This control partially overlaps ISM-1897.
ISM-1897 requires enabling Remote Credential Guard to prevent exposure of credentials during remote connections. E8-RA-ML3.6 requires enabling Credential Guard to protect credential material on the endpoint via virtualisation-based security. They overlap in reducing credential theft, but ISM-1897 is specifically about remote authentication flows whereas E8-RA-ML3.6 focuses on local credential storage and isolation more broadly.
This control depends on ISM-1745.
E8-RA-ML3.6 requires enabling Credential Guard to isolate and protect stored credentials on Windows systems. ISM-1745 requires enabling boot and platform integrity features (Secure Boot, Trusted Boot, Measured Boot, and ELAM), which reduce the likelihood of pre-boot or early-boot compromise that could undermine credential protection mechanisms. These controls are not the same requirement, but ISM-1745 supports the trustworthiness of the platform that Credential Guard depends upon.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-04.1Define approved hardening baselines disabling unneeded services, insecure settings and weak protocolsPartially overlaps
This control partially overlaps IT.PRO-04.1.
IT.PRO-04.1 requires approved configuration baselines that disable or remove unnecessary services, insecure settings and weak protocols; E8-RA-ML3.6 requires Credential Guard functionality to be enabled, a hardening setting such a baseline would include.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.