ASD Essentials IT.PRO-05.1 Restrict Administration to Dedicated, Hardened Environments Isolated from Unprivileged User Workloads
What it says
Ensure administrative activities can only be performed from dedicated and hardened environments that are isolated from unprivileged user workloads.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishRestricts admin work to dedicated, locked-down computers or environments kept apart from everyday email, web browsing and other user tasks.
Administrators should manage key systems, such as firewalls, only from a separate, locked-down setup used for nothing else. To meet this, they use a dedicated admin computer, sometimes through a jump server (a tightly controlled gateway). It runs only admin tools: no email, web browsing or office software. Systems accept admin connections only from it. If a system truly cannot work this way, record the exception, formally accept the risk and add extra safeguards.
Free. Save your status, tasks and notes.
Where this action applies
What's in each domain?ASD orders the work by domain: apply this action to each ticked domain, phase by phase.
- Phase 3
- Business systems (does not apply)
- User devices (does not apply)
Why it matters
Everyday devices are often attacked through email and websites. If administrators use them for admin work, an attacker on the device can steal their sign-in details or take over their sessions. That can hand over firewalls, the staff directory and the security tools themselves.
How to implement
The infrastructure or security architecture lead should list every system and admin interface this action covers.
Record how each is managed today, such as by web console or command line, and plan its move onto the admin setup.
Platform engineers should build admin computers and jump servers from locked-down standard settings based on ASD and vendor guidance.
Remove email, web browsing and office software, and install only the tools needed for approved admin work.
Network and identity teams should separate the admin systems from the wider network and the internet, and stop non-admin accounts signing in to them.
Where admin and everyday work share one computer, stop the everyday side reaching the admin side.
System and network administrators should let admin interfaces accept connections only from approved admin computers and jump servers, using firewall rules.
Block admin sign-ins from any other device, then test that an ordinary staff computer is refused.
The security lead should allow exceptions only for systems that cannot technically be managed this way.
Each needs a reason, a risk assessment, formal risk acceptance, extra safeguards and regular review, and closes once the limit is gone.
Keep it running
Platform engineers keep admin computers and jump servers patched and on their approved settings, so removed features don't creep back. A common gap is a jump server that ordinary staff computers can still reach. The security lead reviews exceptions regularly and closes each one once an upgrade or replacement removes the limit. Move systems onto the admin setup in ASD's priority order: internet-facing and sign-in systems first, then critical and admin systems.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the admin setup design and the list showing how each in-scope system is managed.
Look at
Whether a dedicated, locked-down setup exists, or systems are still managed from ordinary staff computers.
Good evidence
Each in-scope system is managed through the admin setup or an approved exception.
- Check 2 of 5What an auditor asks for
Ask for
Request the standard settings and installed software lists for admin computers and jump servers.
Look at
Whether email, browsing, office software or other unneeded features remain, or non-admin accounts can sign in.
Good evidence
Installed software matches the standard: admin tools only, with no email, browser or office software.
- Check 3 of 5What an auditor asks for
Ask for
Ask the team to try admin access and an admin sign-in from a staff computer.
Look at
Whether this is technically blocked, or admin interfaces are reachable from the staff network or internet.
Good evidence
Both attempts fail, and admin interfaces accept connections only from the admin setup.
- Check 4 of 5What an auditor asks for
Ask for
Request admin session logs for sampled systems and the approved list of admin devices.
Look at
Whether any sessions started elsewhere, such as jump server connections from staff computers.
Good evidence
Every sampled session started in the admin setup, apart from approved exceptions.
- Check 5 of 5What an auditor asks for
Ask for
Ask for the exceptions register with each reason, risk acceptance, extra safeguards and review history.
Look at
Whether exceptions are missing, incomplete, granted for convenience, or still open after the limit was fixed.
Good evidence
Each exception records its technical limit, risk acceptance, safeguards and reviews, and closes when fixed.
ASD indicators of good practice (9)
The indicators below are quoted as published from ASD's Assessment evidence guide for enterprise IT. These optional indicators help an assessor judge the action in each domain where it applies: if any not effective statement is true, the action is rated not effective; if every applicable fully effective statement is true and no other statement is, it is rated fully effective; otherwise it is rated partially effective. ASD says the indicators "do not replace expert judgement, nor are they intended to serve as a checklist".
Not effective(3)
- NE-1Administrative access to systems is routinely performed from standard user devices without additional controls to protect the administrative session.
- NE-2No dedicated or hardened administrative environment exists.
- NE-3Exceptions to the use of dedicated administrative environments are neither identified nor assessed.
Partially effective(3)
- PE-1A dedicated administrative environment has been established, but administrative access is not consistently routed through it.
- PE-2Administrative endpoints have been hardened, but unprivileged user workloads or unnecessary functions remain accessible.
- PE-3Exceptions are documented, but their justification, risk acceptance, compensating controls or review arrangements are incomplete or inconsistently applied.
Fully effective(3)
- FE-1Administrative sessions originate from dedicated and hardened administrative environments that are isolated from unprivileged user workloads. Where this cannot be technically enforced, exceptions are documented, risk-assessed, formally accepted and protected by compensating controls.
- FE-2Administrative environments are hardened and restricted to the functions required for authorised administration.
- FE-3Exceptions are limited to systems or services that cannot support administration through a dedicated environment, are periodically reviewed and are removed when the technical limitation no longer applies.
Mappings
Closest match in ISO/IEC 27001: A.8.2, Management of Privileged Access Rights, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.2.
IT.PRO-05.1 requires administrative activities to be performed only from dedicated, hardened environments that are isolated from unprivileged user workloads. This is a specific restriction on how privileged access rights are used, which Annex A 8.2 requires to be restricted and managed. Annex A 8.2 is broader, also covering the allocation and ongoing management of privileged access rights.
This control partially overlaps A.8.22.
IT.PRO-05.1 requires administrative activities to be performed only from dedicated, hardened environments that are isolated from unprivileged user workloads. Separating administrative users and systems from general user workloads shares common ground with Annex A 8.22, which requires groups of users and information systems to be segregated in the organisation's networks. IT.PRO-05.1 also requires the administrative environment to be hardened, while Annex A 8.22 covers network segregation for all groups of services, users and systems.
ASD Essential Eight: 5 mappings
This control partially overlaps E8-RA-ML1.5.
IT.PRO-05.1 requires administration to happen only in dedicated, hardened environments isolated from unprivileged user workloads; E8-RA-ML1.5 requires privileged users to use separate privileged and unprivileged operating environments, the core of that separation.
- E8-RA-ML1.6Unprivileged user accounts restricted from logging on to privileged environmentsPartially overlaps
This control partially overlaps E8-RA-ML1.6.
IT.PRO-05.1 requires administration to happen only in dedicated, hardened environments isolated from unprivileged user workloads; E8-RA-ML1.6 stops unprivileged user accounts logging on to privileged operating environments, enforcing that isolation from the unprivileged side.
- E8-RA-ML1.7Prevent privileged user accounts from logging on to unprivileged environmentsPartially overlaps
This control partially overlaps E8-RA-ML1.7.
IT.PRO-05.1 requires administration to happen only in dedicated, hardened environments isolated from unprivileged user workloads; E8-RA-ML1.7 stops privileged accounts, other than local administrator accounts, logging on to unprivileged operating environments, enforcing that isolation.
This control partially overlaps E8-RA-ML2.4.
IT.PRO-05.1 requires administration to happen only in dedicated, hardened environments isolated from unprivileged user workloads; E8-RA-ML2.4 requires administrative activities to go through jump servers, one specific way of channelling them through dedicated systems.
This control partially overlaps E8-RA-ML3.2.
IT.PRO-05.1 requires administration to happen only in dedicated, hardened environments isolated from unprivileged user workloads; E8-RA-ML3.2 requires Secure Admin Workstations to be used for administrative activities, a specific form of that dedicated environment.
ASD Information Security Manual: 1 mapping
This control partially overlaps ISM-1385.
IT.PRO-05.1 requires administration to happen only in dedicated, hardened environments isolated from unprivileged user workloads; ISM-1385 requires administrative infrastructure to be segregated from the wider network and the internet, overlapping on isolation at the network level.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.