ASD ISM 1943 Enforce certificate and user mapping in AD services
What it says
Strong mapping between certificates and users is enforced.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure certificates are accurately matched to users within Active Directory.
This control ensures that the digital certificates used for security in your organisation are correctly matched to the people who need them. It's important because if a certificate isn't linked to the right user, it could lead to unauthorised access or data breaches, where someone might gain access to sensitive information they shouldn't see.
Free. Save your status, tasks and notes.
Why it matters
Mismatched certificates and users can lead to unauthorised access, exposing sensitive data and compromising organisational integrity.
How to implement
IT team should verify user identities: Before issuing a certificate, the IT team needs to confirm the user's identity.
They can do this by cross-referencing employee records and confirming with department heads if necessary.
Install authentication software: The IT department should install and configure software that automatically links certificates to the user's account in Active Directory.
This can be set up by following the software vendor's guidelines.
Conduct regular checks: System administrators should regularly audit the certificate mappings.
They can set reminders for periodic checks to ensure that certificates are still valid and matched to the correct users.
Train staff on certificate importance: Managers should organise training sessions to inform staff about how certificates work and why it's crucial they're correctly linked to their accounts.
These sessions can be held annually and should be documented.
Implement an approval process: The IT manager should develop a procedure for certificate approval that involves multiple checks.
This could include a step-by-step workflow requiring several team members to sign off before a certificate is issued or renewed.
Keep it running
Regularly audit user-certificate mappings in AD; remove stale or misaligned entries to prevent security breaches and ensure compliance.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The certificate issuance process document: Request the official procedure document that delineates how certificates are issued and mapped to users.
Look at
Whether it's detailed and includes steps such as user identity verification.
Good evidence
Contains a comprehensive, step-by-step guide with clear roles and responsibilities.
- Check 2 of 5What an auditor asks for
Ask for
Recent audit logs: Request logs of recent checks on certificate mappings to users.
Look at
The records for any mismatches or errors that have been corrected.
Good evidence
Includes documented logs showing periodic checks with issues resolved.
- Check 3 of 5What an auditor asks for
Ask for
Training session records: Request attendance lists and materials from recent training sessions about certificate use and importance.
Look at
How frequently these sessions are conducted and who attended.
Good evidence
Is sessions held at least once a year with high attendance from relevant staff.
- Check 4 of 5What an auditor asks for
Ask for
Evidence of approval records: Request records that show approvals for certificate issuance.
Look at
Multiple approvals from different personnel in each record.
Good evidence
Has multiple sign-offs to ensure thorough vetting.
- Check 5 of 5What an auditor asks for
Ask for
The software configuration settings: Request to see the configuration settings of the software responsible for mapping certificates.
Look at
Automatic processes that ensure correct mapping to users in Active Directory.
Good evidence
Would show automated processes with minimal need for manual intervention.
Mappings
Closest match in ISO/IEC 27001: A.5.16, Identity life cycle management, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.16.
ISM-1943 requires strong mapping controls to ensure certificates are accurately and securely linked to user identities in Active Directory. Annex A 5.16 requires management of the full identity lifecycle (creation, changes, and removal), which underpins maintaining correct bindings between credentials (including certificates) and identities. ISM-1943 focuses on one identity-binding mechanism in AD, whereas Annex A 5.16 covers broader governance and lifecycle processes beyond certificate mapping.
This control partially meets A.8.5.
ISM-1943 requires strong, enforced mapping between X.509 certificates and user identities within Active Directory services so certificate-based authentication/authorisation is correctly bound to the right account. Annex A 8.5 requires implementing secure authentication technologies and procedures based on access restrictions, which can include certificate-based authentication and identity binding. ISM-1943 is a specific technical control for AD certificate-to-user mapping, while Annex A 8.5 is broader and technology-agnostic across authentication methods.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.