ASD ISM 1897 Enable Remote Credential Guard for credential protection
What it says
Remote Credential Guard functionality is enabled.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishActivating Remote Credential Guard helps prevent unauthorised access to security credentials.
Activating Remote Credential Guard is like locking up your sensitive keys to make sure only the right people get to use them. This helps prevent someone from sneaking in and accessing your secure information, which could lead to data breaches or financial loss.
Free. Save your status, tasks and notes.
Why it matters
Without Remote Credential Guard, RDP logons can expose reusable credentials, enabling credential theft and lateral movement across Windows hosts.
How to implement
IT team should review current remote access policies: They need to identify all systems where credential protection is essential, focusing on those accessed remotely.
Ensure these systems have Remote Credential Guard enabled by checking settings in the system configuration.
System administrators should enable Remote Credential Guard on Windows devices: This involves accessing group policy settings on each device and activating the Remote Credential Guard feature.
Follow Microsoft's step-by-step guide to configure this correctly.
IT team should conduct a test: After enabling, run remote access scenarios to confirm that Remote Credential Guard activates when expected.
Use a test environment to safely verify configurations work as intended before full deployment.
Managers should communicate the change to all relevant staff: Explain why this change is important and how it enhances security.
Provide simple guidance on any new steps for remote access they should follow or be aware of.
IT security officer should document the activation process: Keep records of configurations, systems affected, and who verified the setup.
This documentation will be useful for audits and future troubleshooting.
Keep it running
Enforce Remote Credential Guard via Group Policy for all RDP clients/hosts and confirm RDP settings do not permit fallback to standard credential delegation.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The list of systems where Remote Credential Guard is enabled: Request documentation listing all applicable systems and their current configuration status.
Look at
Evidence of deliberate application across remote-accessible systems.
Good evidence
Shows all high-risk systems clearly identified with confirmed activation.
- Check 2 of 5What an auditor asks for
Ask for
To see a live or recorded demonstration illustrating how credentials are protected during remote access sessions.
Look at
Indicator messages confirming Remote Credential Guard activity.
Good evidence
Includes clear evidence of its operation during remote login attempts.
- Check 3 of 5What an auditor asks for
Ask for
Records of configuration changes: Obtain change logs or records documenting when and by whom Remote Credential Guard was enabled.
Look at
Timestamped entries and responsible personnel.
Good evidence
Shows timely implementation, with IT personnel names and dates clearly indicated.
- Check 4 of 5What an auditor asks for
Ask for
Emails, memos, or training documents related to Remote Credential Guard activation.
Look at
Clear messaging and instructions given to staff.
Good evidence
Includes easy-to-understand communication explaining the change and any necessary actions by staff.
- Check 5 of 5What an auditor asks for
Look at
Documented outcomes and any issues or resolutions.
Good evidence
Includes successful test results demonstrating operational functionality without negatively impacting user access.
Mappings
Closest match in ASD Essential Eight: E8-RA-ML3.7, Enable Remote Credential Guard functionality, which asks for the same thing.
ASD Essential Eight: 2 mappings
This control is equivalent to E8-RA-ML3.7.
ISM-1897 requires that Remote Credential Guard functionality is enabled to protect credentials during remote authentication. E8-RA-ML3.7 requires the same control outcome by mandating Remote Credential Guard be enabled. Both controls are materially identical in scope and intent (credential theft reduction for remote logons).
This control partially overlaps E8-RA-ML3.6.
ISM-1897 requires enabling Remote Credential Guard to prevent exposure of credentials during remote connections. E8-RA-ML3.6 requires enabling Credential Guard to protect credential material on the endpoint via virtualisation-based security. They overlap in reducing credential theft, but ISM-1897 is specifically about remote authentication flows whereas E8-RA-ML3.6 focuses on local credential storage and isolation more broadly.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.