Skip to content
System access
ASD ISMISM-1956

ASD ISM 1956 Regularly update AD FS certificates to prevent risks

What it says

Microsoft AD FS token-signing and encryption certificates are changed twice in quick succession if they are compromised, they are suspected of being compromised or they have not been changed in the past 12 months.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

AD FS certificates must be updated twice quickly if compromised or not updated within a year to enhance security.

It's crucial to regularly update your Active Directory Federation Services (AD FS) certificates. If these certificates are outdated or compromised, hackers could gain access to your systems, leading to data breaches and unauthorised access to sensitive information.

Why it matters

Delayed AD FS certificate updates increase risk of token forgery and unauthorised access if token-signing or encryption certificates are compromised or stale.

How to implement

  1. The IT team should designate a staff member to oversee the health and update schedule of AD FS certificates.

    They can use a calendar or reminder tool to ensure certificates are checked every few months, so updates happen at least annually.

  2. Managers should create a policy for everyone involved to follow in case a certificate is suspected of being compromised.

    This should include immediate notification to the IT team and escalation to management for swift response.

  3. System administrators must replace compromised or outdated certificates quickly.

    They should follow a standard procedure that involves backing up the current settings, installing new certificates, and verifying successful implementation through tests.

  4. The IT lead should regularly train their team on recognising signs of certificate issues.

    This could include understanding warning messages or abnormal behaviour in system access logs that might suggest a certificate problem.

  5. Technology supervisors should conduct a quarterly review meeting to go over the status of all organisation certificates.

    They should discuss any changes needed and assign tasks for those updates to ensure no lapse in security.

Keep it running

Rotate AD FS token-signing and encryption certificates at least every 12 months. If compromise is suspected, perform two rapid successive certificate changes and update relying parties.

Evidence and audit

  1. Check 1 of 4What an auditor asks for

    Ask for

    The certificate management policy document: Ensure it outlines procedures for updating and handling compromised certificates.

    Look at

    Specific timelines and responsibilities assigned.

    Good evidence

    Is a comprehensive, clear policy document with distinct roles and schedules for review and updates.

  2. Check 2 of 4What an auditor asks for

    Ask for

    Training records or transcripts.

    Look at

    Dates within the past year, highlighting a good practice of keeping staff informed about any changes in procedures.

  3. Check 3 of 4What an auditor asks for

    Ask for

    To see the IT department's reminder system.

    Look at

    Their calendar events or reminder software to confirm regular checks on certificate status are scheduled.

    Good evidence

    Is a detailed schedule showing reminders set frequently throughout the year.

  4. Check 4 of 4What an auditor asks for

    Good evidence

    Includes clear documentation of incidents and swift action taken to secure systems.

Mappings

Closest match in ISO/IEC 27001: A.5.26, Response to information security incidents, which partially overlaps with this control.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.5.26Response to information security incidentsPartially overlaps

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.