ASD ISM 1686 Enable Credential Guard for credential protection
What it says
Credential Guard functionality is enabled.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishCredential Guard is activated to better protect user credentials from unauthorised access.
Credential Guard is a security feature that helps to protect your passwords and sensitive login information from being stolen by hackers. If it's not enabled, a cybercriminal could potentially get hold of your login details and access your systems, risking your data and operations.
Free. Save your status, tasks and notes.
Why it matters
Without Credential Guard, attackers can intercept and reuse credentials, potentially leading to unauthorised access and data breaches.
How to implement
The IT team should check if the version of Windows used in the organisation supports Credential Guard.
They can do this by reviewing Microsoft's list of compatible versions online. It's essential to ensure your operating system is up-to-date and compatible.
System administrators need to enable Credential Guard through the Windows Group Policy.
They can navigate to the system configurations on each computer and turn on Credential Guard by following a step-by-step guide provided by Microsoft or similar sources.
IT managers should assess the current network infrastructure to ensure Credential Guard is correctly propagated across all devices.
This might involve a review meeting with the IT team to discuss what devices need updating and ensure policies are consistently applied.
Business owners should allocate resources for training staff on the importance of Credential Guard.
They can organise short IT workshops to explain how Credential Guard helps keep company data secure and the procedures involved if any issues arise.
The IT support team should regularly test Credential Guard's functionality by conducting security audits or penetration tests.
This will help identify any devices where Credential Guard might not be working correctly and needs attention.
Keep it running
Regularly verify Credential Guard is enabled, running, and reporting expected events to protect credentials from theft and reuse.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The list of all devices with Credential Guard enabled: Request a comprehensive inventory of all computers and servers where Credential Guard has been activated.
Look at
The list to ensure it includes all relevant devices as per the system list.
Good evidence
Shows a complete match between the registered devices and the actual infrastructure.
- Check 2 of 5What an auditor asks for
Ask for
Windows Group Policy documentation: Request the policy settings document that shows Credential Guard configuration.
Look at
Clear settings that specify Credential Guard activation.
Good evidence
Includes detailed descriptions and evidence that the policy is enforced across all devices.
- Check 3 of 5What an auditor asks for
Ask for
Documents showing staff have been trained about Credential Guard.
Look at
Sign-in sheets, training agendas, and feedback forms.
Good evidence
Outcome demonstrates regular training sessions and positive feedback from staff.
- Check 4 of 5What an auditor asks for
Ask for
Reports showing testing of Credential Guard's effectiveness.
Look at
The outcome details which should note any issues found or best practices confirmed.
Good evidence
Report would highlight successful tests and no major vulnerabilities.
- Check 5 of 5What an auditor asks for
Ask for
Records of system updates relevant to Credential Guard: Request logs or documents that show when systems were updated to support Credential Guard.
Look at
Dates and version numbers to ensure they're current. A solid answer has up-to-date logs and a stable update history.
Mappings
Closest match in ASD Essential Eight: E8-RA-ML3.6, Enable Credential Guard for secure credential storage, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.1.
ISM-1686 requires enabling Credential Guard as a specific technical control to protect user credentials from unauthorised access on Windows endpoints. Annex A 8.1 requires protection of information stored on, processed by, or accessible via user endpoint devices more broadly. ISM-1686 is one specific mechanism that can contribute to meeting Annex A 8.1, but Annex A 8.1 also covers many other endpoint protections beyond credential isolation.
ASD Essential Eight: 3 mappings
This control is equivalent to E8-RA-ML3.6.
ISM-1686 requires Credential Guard functionality to be enabled to protect user credentials from unauthorised access. E8-RA-ML3.6 states the same requirement to enable Credential Guard for secure credential storage. Both controls are aligned in scope and intent, with no material difference in depth beyond framework context.
This control partially overlaps E8-RA-ML3.5.
ISM-1686 requires Credential Guard functionality to be enabled to better protect credentials in Windows environments. E8-RA-ML3.5 requires Local Security Authority (LSA) protection to be enabled, which also hardens credential-handling processes and reduces credential theft risk. The controls overlap in their goal of protecting credentials in memory, but they are distinct Windows security features and enabling one does not automatically enable the other.
This control partially overlaps E8-RA-ML3.7.
ISM-1686 requires enabling Credential Guard to protect credentials on endpoints from unauthorised access. E8-RA-ML3.7 requires enabling Remote Credential Guard to protect credentials during remote authentication sessions (e.g. RDP). They share a common technical lineage and objective (reducing credential exposure), but Remote Credential Guard is session/remote-access focused while ISM-1686 is about endpoint credential isolation via Credential Guard generally.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.