ASD Essentials IT.PRO-05.2 Require Explicit Session Establishment and Time-Bound Grants for Privileged Actions
What it says
Enforce explicit session establishment controls before privileged actions are permitted, including the use of time-bound privilege grants.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishSwitches on admin access only when needed, after a fresh identity check, and switches it off automatically after a set time.
Administrators should not have powerful access all the time. When they need it, they switch on just the admin role they need and prove who they are again, for example with a security key. The access then switches off by itself after a set time, and every use is logged. To meet this, every admin role works this way, except approved emergency accounts kept for when normal sign-in fails.
Free. Save your status, tasks and notes.
Where this action applies
What's in each domain?ASD orders the work by domain: apply this action to each ticked domain, phase by phase.
- Phase 3
- Business systems (does not apply)
- User devices (does not apply)
Why it matters
If admin access is always on, a stolen administrator password or login session works straight away. An attacker could then take over firewalls, the staff directory and critical systems. Sessions that last too long keep that door open.
How to implement
The head of security should approve a written list of every admin role.
For each one, record whether it must be switched on when needed, its maximum session time and the emergency access arrangements.
Identity administrators should replace permanent admin access with roles people must switch on, which switch off by themselves at the time limit.
Only approved emergency accounts keep permanent access.
The identity team should require a fresh login check, such as a security key tap, and a reason at each switch-on.
Release devices' own admin logins only after the same check, for example from a password vault.
System owners should make each system refuse admin tasks unless a role is switched on.
Set session and login timeouts no longer than the time limit, rather than leaving longer defaults.
Security operations should collect every switch-on record, showing who, which role, and the start and end times.
Report any permanent admin access, sessions that run too long and every use of an emergency account.
Keep it running
The identity team runs the switch-on process, and security operations checks the reports regularly and fixes the cause of each problem. Watch for permanent admin access creeping back, and for time limits being extended again and again. Follow ASD's priority order: internet-facing and sign-in systems first, then critical and admin systems.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the admin access standard, the emergency access arrangements and records of emergency account use.
Look at
Whether any admin role has no time limit, or emergency accounts are unapproved or used for routine work.
Good evidence
Each admin role has a time limit, and every emergency account use was approved.
- Check 2 of 5What an auditor asks for
Ask for
Request a current list of who holds each admin role, including local admin accounts.
Look at
Whether anyone has permanent admin access apart from emergency accounts, or only some roles are time-limited.
Good evidence
No one holds permanent admin access except approved emergency accounts.
- Check 3 of 5What an auditor asks for
Ask for
Ask an administrator to try an admin task before and after switching on their role.
Look at
Whether the task is blocked until the role is on, and switching on asks for a fresh check.
Good evidence
The task is blocked until the role is on, and switching on prompts a fresh check.
- Check 4 of 5What an auditor asks for
Ask for
Request session and login timeout settings on a sample of systems.
Look at
Whether sessions outlast the time limit, or time limits get extended without a fresh switch-on.
Good evidence
Sessions end when the time limit does, and expired roles stop working.
- Check 5 of 5What an auditor asks for
Ask for
Request the switch-on logs and admin activity records for the same systems and period.
Look at
Whether entries miss the person, role or times, or admin work happened with no matching switch-on.
Good evidence
Every switch-on names the person, role, start and end, and all admin work matches one.
ASD indicators of good practice (7)
The indicators below are quoted as published from ASD's Assessment evidence guide for enterprise IT. These optional indicators help an assessor judge the action in each domain where it applies: if any not effective statement is true, the action is rated not effective; if every applicable fully effective statement is true and no other statement is, it is rated fully effective; otherwise it is rated partially effective. ASD says the indicators "do not replace expert judgement, nor are they intended to serve as a checklist".
Not effective(2)
- NE-1Privileged access is standing and does not require explicit activation or time-bound grants, excluding approved break-glass and emergency access accounts.
- NE-2No re-authentication or step-up authentication is required before privileged sessions.
Partially effective(2)
- PE-1Time-bound access is implemented for some privileged roles but standing access remains for others.
- PE-2Session duration limits exist but are not consistently enforced or are set excessively long.
Fully effective(3)
- FE-1Time-bound privilege grants are enforced for applicable privileged roles, with defined maximum session durations and approved emergency access arrangements.
- FE-2Re-authentication or step-up authentication is required before privilege activation.
- FE-3All privilege activations are logged with activating user, role and timeframes.
Mappings
Closest match in ISO/IEC 27001: A.8.2, Management of Privileged Access Rights, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.2.
IT.PRO-05.2 requires explicit session establishment controls before privileged actions are permitted, including time-bound privilege grants. This is a specific way of restricting and managing the use of privileged access rights, as Annex A 8.2 requires. Annex A 8.2 is broader, also covering who is allocated privileged access rights and how those rights are managed.
ASD Essential Eight: 1 mapping
- E8-RA-ML3.3Just-in-time administration is used for administering systems and applications.Partially overlaps
This control partially overlaps E8-RA-ML3.3.
IT.PRO-05.2 requires explicit session establishment controls before privileged actions are permitted, including time-bound privilege grants; E8-RA-ML3.3 requires just-in-time administration of systems and applications, which closely matches those time-bound grants.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.