Skip to content
System hardening
ASD ISMISM-1945

ASD ISM 1945 Remove enrollee supplies subject flag from templates

What it says

The CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT flag is removed from certificate templates.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Ensure certificate templates do not allow users to supply their own subject information.

This control ensures that when people apply for digital certificates, which are like digital ID cards, they can't fill in their own personal information. It's important because if this step isn't followed, someone might pretend to be someone else, leading to potential fraud or security breaches.

Why it matters

If users can supply subject details in templates, certificates can be issued with spoofed identities, enabling unauthorised access to systems and data.

How to implement

  1. System owners should review current digital certificate templates to ensure they don't allow users to provide their own personal information.

    They can do this by checking the settings in their Microsoft Active Directory Certificate Services (AD CS) management console, focusing on the CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT setting.

  2. IT administrators should update the certificate template settings to remove any option that lets users fill in their own details.

    This involves accessing the template properties in the AD CS and unchecking the specific flag that allows enrollee supplies for subject information.

  3. Managers should organise training sessions for staff involved in certificate management to ensure they understand the importance of these changes.

    This training can be a webinar or a workshop, explaining why strict control over certificate issuance is necessary.

  4. Security officers should regularly verify that the correct settings are applied to all templates.

    They can do this by setting up periodic checks within their security audits to confirm compliance with this control.

  5. Procurement teams should ensure that any external IT service providers also comply with these requirements.

    They can include specific clauses in contracts that mandate alignment with this certificate management control.

Keep it running

Periodically review certificate templates and confirm CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT is removed, so enrollee-supplied subject names cannot be used.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The current list of certificate templates used in the organisation.

    Look at

    Each template's properties to ensure the 'Enrollee Supplies Subject' option is not selected.

    Good evidence

    Shows a complete absence of this option on all templates.

  2. Check 2 of 5What an auditor asks for

    Look at

    Any recent changes that include disabling user-supplied subject information.

    Good evidence

    Audit result confirms these changes were made and documented.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Training records or agendas showing that staff responsible for certificate management received updated training.

    Look at

    Documented sessions or webinars specifically addressing template security.

    Good evidence

    Is evidence of completed training sessions with an overview of topics covered.

  4. Check 4 of 5What an auditor asks for

    Look at

    The terms related to certificate management to confirm they align with this control.

    Good evidence

    Includes specific clauses about removing user-specified subject information.

  5. Check 5 of 5What an auditor asks for

    Ask for

    The results of recent internal security audits that covered certificate template configuration.

    Look at

    The findings to ensure this control was checked and passed.

    Good evidence

    Shows a positive audit result, indicating compliance.

Mappings

Closest match in ISO/IEC 27001: A.8.24, Effective use of cryptography and key management, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.8.24Effective use of cryptography and key managementPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.