ASD ISM 1749 Limit cached credentials to single logon
What it says
Cached credentials are limited to one previous logon.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUsers' credentials are stored only for their last login to enhance security.
This control means that when you log into your work computer or system, it will only remember details from your last login. This is important because if a hacker gains access to your computer, they'll only find your most recent login details, reducing the chance they can get into other systems or services with older credentials.
Free. Save your status, tasks and notes.
Why it matters
Failure to limit cached credentials risks unauthorised access using older logins, exposing sensitive data and escalating potential breaches.
How to implement
System administrators should adjust settings on all company computers and systems so they only keep the last login details.
They can do this by accessing the system's security settings and setting the cached logons to one.
The IT team should document the process for limiting cached logins as a policy.
This involves writing a clear step-by-step guide that outlines how to set these configurations on each type of device the organisation uses.
Business managers should schedule regular training sessions on security protocols.
These sessions will explain why login limits are crucial and how employees can protect their credentials better.
Procurement should ensure that any new hardware or software purchased supports the ability to limit cached credentials.
When evaluating new purchases, they should check technical specifications or ask vendors directly about this feature.
IT personnel should regularly review and update all devices to ensure they continue to comply with this requirement by running routine checks and updating system settings as needed.
Keep it running
Set Windows 'CachedLogonsCount' to 1 via policy and audit the setting regularly to detect configuration drift.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The security configuration documentation: Request a copy of the policy that describes how cached logins are limited to one.
Look at
Whether the document includes detailed steps on setting cached logons.
Good evidence
A well-documented policy with clear instructions on implementing this control.
- Check 2 of 5What an auditor asks for
Ask for
To see system settings: Have the IT team demonstrate the configuration on a sample computer.
Look at
Settings where cached logons are limited to one.
Good evidence
The system clearly shows the setting is enabled and active.
- Check 3 of 5What an auditor asks for
Ask for
A list of all systems and devices: Request an inventory showing which systems have this control applied.
Look at
Whether the list is complete and databases reflect current settings.
Good evidence
A comprehensive list where control implementation is marked and matched against settings.
- Check 4 of 5What an auditor asks for
Ask for
Records of implementation training sessions: Check if training on limiting cached credentials has been conducted.
Look at
Attendance records and training materials.
Good evidence
Evidence of regular, completed sessions with participant lists.
- Check 5 of 5What an auditor asks for
Ask for
To review vendor specifications for new hardware/software: Verify that new purchases support limiting cached logons.
Look at
Delivery documentation or pre-purchase checklists.
Good evidence
Confirmation from vendors or system data sheets outlining this capability.
Mappings
Closest match in ISO/IEC 27001: A.8.1, Protection of user endpoint devices, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.1.
ISM-1749 requires the number of cached logon credentials on a system to be limited to one previous logon. This directly protects information stored on user endpoint devices, as required by Annex A 8.1, by reducing the credential material an attacker could extract from a lost, stolen or compromised workstation. Annex A 8.1 covers the full range of endpoint device protections, whereas ISM-1749 is a single hardening setting for credential caching.
This control partially meets A.8.5.
ISM-1749 requires cached credentials to be limited to one previous logon, reducing the credential material stored on a device that an attacker could extract or use offline. This is a specific secure authentication configuration that forms part of the secure authentication technologies and procedures Annex A 8.5 requires. Annex A 8.5 covers authentication design and log-on procedures across all systems, while ISM-1749 addresses only the caching of logon credentials.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.