Privileged access is reviewed: switched off after 45 days of inactivity and after 12 months unless revalidated

Privileged access to systems, applications and data repositories is disabled after 12 months unless revalidated. Required at Maturity Levels Two and Three of the Restrict administrative privileges mitigation strategy (Appendices B and C); ISM control ISM-1647 in ASD's Essential Eight to ISM mapping (December 2023).

The requirement's own words: after 12 months unless revalidated

evidence an assessor asks for Revalidation records for privileged access at least every 12 months; Report of accounts disabled for lack of revalidation

Privileged access to systems and applications is disabled after 45 days of inactivity. Required at Maturity Levels Two and Three of the Restrict administrative privileges mitigation strategy (Appendices B and C); ISM control ISM-1648 in ASD's Essential Eight to ISM mapping (December 2023).

The requirement's own words: after 45 days of inactivity

evidence an assessor asks for Automated rule disabling privileged access after 45 days of inactivity; Inactive privileged account report

All user accounts and their related access privileges, including third-party and vendor accounts, must be reviewed at least every six months. The review must confirm that accounts and access remain appropriate for each person's job function, any inappropriate access must be dealt with, and management must acknowledge that the remaining access is appropriate. The guidance notes the review is also a chance to catch terminated users and third parties whose access was missed. Applicability: covers every user account and related privilege, including accounts of personnel, of vendors and of other third parties and accounts used to reach third-party cloud services; application and system accounts are handled instead by Requirement 7.2.5 (and its sub-requirement) and by 8.6.1 to 8.6.3. Objective under the customized approach: management periodically verifies that account privilege assignments are correct and remediates nonconformities. Future-dated: treated as a best practice up to 31 March 2025 and mandatory since then.

The requirement's own words: every six months

evidence an assessor asks for Semi-annual user access review records for each in-scope system, with review dates; Evidence that inappropriate access found was removed or corrected, such as closed tickets; Management sign-off acknowledging access remains appropriate; Inventory of third-party, vendor and cloud-service accounts included in the review scope

Where supported, remove or disable any account that has been dormant for 45 days.

evidence an assessor asks for Directory report of accounts inactive for 45 days or more; Automated disablement configuration or tickets showing dormant accounts disabled; Scheduled job or identity governance rule configuration disabling accounts after 45 days without logon; Exception list for dormant accounts retained, with owner approval; Cloud identity provider and SaaS inactive user reports checked alongside the directory

Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties

evidence an assessor asks for Access policy framework with role definitions; Privileged access management deployment evidence; Periodic access reviews with sign off; Segregation of duties matrix; Just in time access workflow records

All user accounts and their related access privileges, including third-party and vendor accounts, must be reviewed at least every six months. The review must confirm that accounts and access remain appropriate for each person's job function, any inappropriate access must be dealt with, and management must acknowledge that the remaining access is appropriate. The guidance notes the review is also a chance to catch terminated users and third parties whose access was missed. Applicability: covers every user account and related privilege, including accounts of personnel, of vendors and of other third parties and accounts used to reach third-party cloud services; application and system accounts are handled instead by Requirement 7.2.5 (and its sub-requirement) and by 8.6.1 to 8.6.3. Objective under the customized approach: management periodically verifies that account privilege assignments are correct and remediates nonconformities. Future-dated: treated as a best practice up to 31 March 2025 and mandatory since then.

The requirement's own words: every six months

evidence an assessor asks for Semi-annual user access review records for each in-scope system, with review dates; Evidence that inappropriate access found was removed or corrected, such as closed tickets; Management sign-off acknowledging access remains appropriate; Inventory of third-party, vendor and cloud-service accounts included in the review scope

Limit user access privileges to Nonpublic Information based on least privilege, limit privileged accounts, periodically review access (at least annually), promptly terminate access on role change or separation, disable or securely configure remote access, implement password policy aligned with industry standards. Class A must implement privileged access management and prohibit commonly used passwords.

evidence an assessor asks for Access control policy with least privilege standard; Privileged account inventory and PAM tooling for Class A; Annual user access reviews with attestations; Joiners movers leavers process with timing metrics; Password policy aligned to NIST or equivalent; Banned password list enforcement (Class A); Remote access architecture and MFA evidence

Review user accounts with special access privileges on a regular basis and remove or downgrade where no longer needed.

evidence an assessor asks for quarterly admin review records; access review attestation; removed/downgraded log

All user accounts and their related access privileges, including third-party and vendor accounts, must be reviewed at least every six months. The review must confirm that accounts and access remain appropriate for each person's job function, any inappropriate access must be dealt with, and management must acknowledge that the remaining access is appropriate. The guidance notes the review is also a chance to catch terminated users and third parties whose access was missed. Applicability: covers every user account and related privilege, including accounts of personnel, of vendors and of other third parties and accounts used to reach third-party cloud services; application and system accounts are handled instead by Requirement 7.2.5 (and its sub-requirement) and by 8.6.1 to 8.6.3. Objective under the customized approach: management periodically verifies that account privilege assignments are correct and remediates nonconformities. Future-dated: treated as a best practice up to 31 March 2025 and mandatory since then.

The requirement's own words: every six months

evidence an assessor asks for Semi-annual user access review records for each in-scope system, with review dates; Evidence that inappropriate access found was removed or corrected, such as closed tickets; Management sign-off acknowledging access remains appropriate; Inventory of third-party, vendor and cloud-service accounts included in the review scope

The granting and use of privileged access rights are to be limited and managed. Purpose (stated in ISO/IEC 27002:2022): limits privileged access to authorized people, software components and services. As an Annex A reference control, it is compared with the controls determined in risk treatment (6.1.3 c) and recorded in the Statement of Applicability as included or excluded, with the justification and implementation status (6.1.3 d); implementation guidance is ISO/IEC 27002:2022 8.2.

evidence an assessor asks for Statement of Applicability entry for control A.8.2, showing inclusion or justified exclusion, implementation status and the risks it treats; An inventory of privileged accounts per system (operating systems, databases, applications, cloud consoles) mapped to named individuals; Authorization records for each privileged grant with approver, justification and expiry; Privileged access management configuration showing time-limited elevation, step-up authentication and session recording; Privileged access review records performed periodically and after organizational changes