| Ignored | Use when you don't want a field to appear in issued certificates, whether requested or not. |
| Forbidden | Use for fields that you want to exclude from certificate signing requests. |
| Optional | Use for fields to allow in the issued certificate as long as the value complies with the policy. If not specified, the Default Value is used. |
| Required | Use when you want to require a field in every certificate signing request. If selected, client requests must match the Default Value. |
| Locked | Use when you want to enforce a value that clients can't override and to prevent additional values from being added. The Default Value is the enforced value. |
