ASD ISM 1946 Restrict write access to certificate templates
What it says
Unprivileged user accounts do not have write access to certificate templates.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure regular users can't change certificate templates to maintain security.
This control is about making sure that regular users in your organisation can't change the templates used to create digital certificates. These certificates are crucial for secure communication in your IT systems. If unauthorised people can change them, they might create fake certificates that compromise your security, leading to data breaches or system misuse.
Free. Save your status, tasks and notes.
Why it matters
Unauthorised template changes could lead to fraudulent certificates, compromising secure communications and exposing systems to data breaches.
How to implement
IT administrators should review the current permissions on certificate templates.
Check who currently has the ability to change these templates and adjust settings so only authorised personnel can make changes.
The IT team should implement role-based access controls specifically for certificate management.
Define roles within your organisation, assigning write access to certificate templates only to those who truly need it for their job.
System owners should ensure any system updates or changes to access policies are documented and communicated clearly to all staff.
This ensures that everyone understands who can and cannot change certificate templates.
Managers should organise regular training sessions for staff involved with certificate management.
This training should focus on the importance of maintaining strict access controls and the potential risks of unauthorised changes.
Security officers should implement a periodic review process for access rights.
This involves checking if the listed personnel who can access and modify certificate templates are still valid and required.
Keep it running
Audit certificate template ACLs and AD CS role assignments regularly so only privileged admins can write or publish templates; remove any unprivileged write access.
Evidence and audit
- Check 1 of 3What an auditor asks for
Ask for
The list of personnel with write access to certificate templates. Review this list for clarity on roles and individuals involved.
Good evidence
Will show that only essential personnel, such as senior IT staff, are authorised to make changes.
- Check 2 of 3What an auditor asks for
Ask for
To see records of changes made to certificate templates over the past year. Check these records for timestamps, user actions, and authorisation notes. A comprehensive log with minimal authorised changes and no suspicious entries is a good sign.
Good evidence
Audit shows all relevant personnel attended and training covered security protocols adequately.
- Check 3 of 3What an auditor asks for
Look at
Evidence of regular evaluations and updates on who has access. Good evidence shows consistent, timely reviews with corrective actions documented if necessary.
Mappings
Closest match in ISO/IEC 27001: A.5.15, Access control policies and procedures, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.5.15.
ISM-1946 requires organisations to enforce a specific logical access rule: unprivileged users must not be able to write to certificate templates. This aligns with Annex A 5.15 as certificate template permissions are an access control rule that should be defined and implemented based on information security requirements. Annex A 5.15 is broader because it addresses organisation-wide access control policies and procedures, whereas ISM-1946 is a targeted technical restriction for PKI template objects.
This control partially meets A.5.18.
ISM-1946 requires preventing unprivileged accounts from having write access to certificate templates to protect certificate issuance configuration from tampering. This relates to Annex A 5.18 because certificate templates are information system assets whose access rights must be provisioned and controlled (including removal of inappropriate write permissions). Annex A 5.18 is broader as it covers the full lifecycle of access rights management for all information assets, not just certificate template modification rights.
This control partially meets A.8.2.
ISM-1946 requires that unprivileged user accounts do not have write access to certificate templates to prevent unauthorised changes to PKI issuance settings. This relates to Annex A 8.2 because restricting who can change certificate templates is a specific instance of managing and restricting privileged access rights to sensitive security functions. Annex A 8.2 is broader as it covers the governance and restriction of privileged access rights across systems and use cases, not just certificate template write permissions.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.