Requests for privileged access are checked and signed off when first requested, and privileged accounts are tracked

Requests for privileged access to systems, applications and data repositories are validated when first requested. Required at Maturity Levels One, Two and Three of the Restrict administrative privileges mitigation strategy (Appendices A, B and C); ISM control ISM-1507 in ASD's Essential Eight to ISM mapping (December 2023).

evidence an assessor asks for Privileged access request forms or tickets with validation and approver; Sample of new privileged accounts traced to approved requests

Access for every user, including privileged users, must be assigned on the basis of the user's job classification and function, and restricted to the least privileges needed to perform that person's responsibilities. The guidance explains that once role needs are defined under 7.2.1, individuals can be granted access by placing them in the matching roles, gives the example that a database or backup administrator should not hold the full privileges of a systems administrator, and suggests entities may consider privileged access management that grants elevated rights only when needed and removes them afterwards. Objective under the customized approach: access to systems and data is confined to what each job function needs, as set out in the related access roles.

evidence an assessor asks for User access provisioning procedure referencing job classification and least privilege; Export of user-to-role and user-to-group assignments, including privileged groups; Sample of privileged user records compared with their job descriptions; PAM tool configuration or just-in-time elevation logs where used

Keep a register of every account the enterprise manages, covering both user and administrator accounts. At a minimum each entry should hold the person's name, the username, the start and end dates, and the department. Confirm that every active account is authorised on a regular cycle of at least once a quarter.

The requirement's own words: at least once a quarter

evidence an assessor asks for Account inventory showing name, username, start and end dates and department for user and admin accounts; Quarterly account validation records; Identity management standard naming who authorises accounts and the quarterly validation cadence; Reconciliation of the account inventory against the HR system showing mismatches and actions taken; Inventory entries for service and shared accounts with an accountable owner recorded

Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties

evidence an assessor asks for Access policy framework with role definitions; Privileged access management deployment evidence; Periodic access reviews with sign off; Segregation of duties matrix; Just in time access workflow records

Access controls, technical and where appropriate physical, are implemented and periodically reviewed to authenticate and permit access only to authorised users so as to protect against unauthorised acquisition of customer information, and to limit authorised users to the customer information they need for their duties and functions, or, for customers, to their own information.

evidence an assessor asks for Access control policy and user access reviews; Role-based permissions limiting access to need; Customer self-service access limited to own records

Access for every user, including privileged users, must be assigned on the basis of the user's job classification and function, and restricted to the least privileges needed to perform that person's responsibilities. The guidance explains that once role needs are defined under 7.2.1, individuals can be granted access by placing them in the matching roles, gives the example that a database or backup administrator should not hold the full privileges of a systems administrator, and suggests entities may consider privileged access management that grants elevated rights only when needed and removes them afterwards. Objective under the customized approach: access to systems and data is confined to what each job function needs, as set out in the related access roles.

evidence an assessor asks for User access provisioning procedure referencing job classification and least privilege; Export of user-to-role and user-to-group assignments, including privileged groups; Sample of privileged user records compared with their job descriptions; PAM tool configuration or just-in-time elevation logs where used

Implement an approval process and keep track of privileged (administrative) accounts. The granting of privileges must be controlled.

evidence an assessor asks for list of all admin accounts with owner; approval records; PAM tool inventory

Access for every user, including privileged users, must be assigned on the basis of the user's job classification and function, and restricted to the least privileges needed to perform that person's responsibilities. The guidance explains that once role needs are defined under 7.2.1, individuals can be granted access by placing them in the matching roles, gives the example that a database or backup administrator should not hold the full privileges of a systems administrator, and suggests entities may consider privileged access management that grants elevated rights only when needed and removes them afterwards. Objective under the customized approach: access to systems and data is confined to what each job function needs, as set out in the related access roles.

evidence an assessor asks for User access provisioning procedure referencing job classification and least privilege; Export of user-to-role and user-to-group assignments, including privileged groups; Sample of privileged user records compared with their job descriptions; PAM tool configuration or just-in-time elevation logs where used

The granting and use of privileged access rights are to be limited and managed. Purpose (stated in ISO/IEC 27002:2022): limits privileged access to authorized people, software components and services. As an Annex A reference control, it is compared with the controls determined in risk treatment (6.1.3 c) and recorded in the Statement of Applicability as included or excluded, with the justification and implementation status (6.1.3 d); implementation guidance is ISO/IEC 27002:2022 8.2.

evidence an assessor asks for Statement of Applicability entry for control A.8.2, showing inclusion or justified exclusion, implementation status and the risks it treats; An inventory of privileged accounts per system (operating systems, databases, applications, cloud consoles) mapped to named individuals; Authorization records for each privileged grant with approver, justification and expiry; Privileged access management configuration showing time-limited elevation, step-up authentication and session recording; Privileged access review records performed periodically and after organizational changes