ASD Essentials IT.PRO-12.1 Periodically Review and Update Access Privileges to Match Current Roles and Duties
What it says
Periodically review and update access privileges in alignment with current roles, duties and business requirements.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishReviews each account's access on a set cycle and updates it to match current roles, duties and business needs.
People and systems build up access they no longer need. To meet this, write down what access each role, duty and business need requires. Review every account on every system against that list on a set cycle, including admin accounts and accounts used by apps. Remove extra access within your set timeframe and keep each decision on file. Update access between reviews when roles change, such as a move from finance to sales.
Free. Save your status, tasks and notes.
Where this action applies
What's in each domain?ASD orders the work by domain: apply this action to each ticked domain, phase by phase.
- Phase 3
Why it matters
Without regular reviews, access piles up beyond what people's current jobs need. One stolen account can then reach far more systems and data than it should. If an attacker quietly adds access to accounts they control, that also goes unnoticed.
How to implement
Business and system owners should map the access each role, duty and business need requires, for example in a table of roles and groups.
Cover user, admin and app accounts, so any access with no current purpose stands out.
The head of security or a delegated owner should approve a review procedure covering every account and system.
It sets how often reviews run, who does them and the deadline for removing or changing access.
Line managers and system owners should compare each access right in a current access report with the role table.
They record keep, change or remove, with a reason, and never approve their own access.
The identity team should make each change or removal through a tracked ticket within the set timeframe.
They confirm it on the live system and file the decisions and tickets as evidence.
HR, project managers and system owners should tell the identity team when roles, duties or business needs change, such as a project ending.
The identity team then updates access, removing the old access rather than only adding new.
Keep it running
Line managers confirm their staff's access, and system owners confirm the roles and app accounts on their systems. Run reviews on the set cycle, not just before an audit. Watch for reviewers who approve everything in one go. Fold any existing checks of admin access into the same cycle. Follow ASD's priority order: internet-facing and sign-in systems first, then critical and admin systems, then business systems and staff devices.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the table linking roles to access, for sampled systems in each ASD domain.
Look at
Whether live access rights trace to a current role, duty or business need, or only some do.
Good evidence
Every sampled access right matches the current role table, with no unexplained extras.
- Check 2 of 5What an auditor asks for
Ask for
Request the review procedure, recent review records and the list of all accounts and systems.
Look at
Whether reviews ran on schedule or only now and then, and which accounts or systems were missed.
Good evidence
Review records cover every account and system, each finished within the cycle.
- Check 3 of 5What an auditor asks for
Ask for
Ask for completed review records for sampled systems, showing each decision and its reason.
Look at
Whether reviews find unneeded access, or show bulk approvals, no removals for several cycles, or self-approval.
Good evidence
Each access right has a keep, change or remove decision with a reason, never self-approved.
- Check 4 of 5What an auditor asks for
Ask for
Request last cycle's change tickets and the set deadlines for removing or changing access.
Look at
Whether flagged access is gone from live systems, or tickets are open, late or closed with no change.
Good evidence
Sampled flagged access is gone from live systems, with tickets closed within the deadline.
- Check 5 of 5What an auditor asks for
Ask for
Ask for recent role and business changes, with the access changes raised for each.
Look at
Whether access was left unchanged, or new access was added while the old access remained.
Good evidence
Each sampled change has a ticket that added the new access and removed the old.
ASD indicators of good practice (12)
The indicators below are quoted as published from ASD's Assessment evidence guide for enterprise IT. These optional indicators help an assessor judge the action in each domain where it applies: if any not effective statement is true, the action is rated not effective; if every applicable fully effective statement is true and no other statement is, it is rated fully effective; otherwise it is rated partially effective. ASD says the indicators "do not replace expert judgement, nor are they intended to serve as a checklist".
Not effective(4)
- NE-1Access privileges are not reviewed against current roles, duties and business requirements.
- NE-2Access reviews do not identify privileges that are no longer required.
- NE-3Access privileges are not updated when personnel roles, duties or business requirements change.
- NE-4Access privileges are not mapped to roles, duties and business requirements.
Partially effective(4)
- PE-1Access reviews are conducted for some accounts or systems, but coverage is incomplete.
- PE-2Reviews identify excessive or obsolete privileges, but updates are incomplete or not completed within timeframes defined by the organisation.
- PE-3A process to review access privileges exists but only occurs on an ad hoc basis.
- PE-4Some access privileges are mapped to roles, duties and business requirements, but not all.
Fully effective(4)
- FE-1Access privileges for all applicable accounts and systems are reviewed within a cycle defined by the organisation and aligned with current roles, duties and business requirements.
- FE-2Privileges identified as excessive or obsolete are removed or updated within timeframes defined by the organisation.
- FE-3Review outcomes and resulting access changes are documented and available as evidence.
- FE-4Access privileges are mapped to current roles, duties and business requirements.
Mappings
Closest match in ISO/IEC 27001: A.5.18, Managing Access Rights to Information Assets, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.18.
IT.PRO-12.1 requires access privileges to be periodically reviewed and updated so they stay aligned with current roles, duties and business requirements. This directly implements the review and modification of access rights required by Annex A 5.18. Annex A 5.18 is broader, also covering the provisioning and removal of access rights in line with the access control policy and rules.
This control partially overlaps A.8.2.
IT.PRO-12.1 requires access privileges to be periodically reviewed and updated in line with current roles, duties and business requirements. Applied to privileged accounts, this review is part of restricting and managing privileged access rights under Annex A 8.2. IT.PRO-12.1 also covers non-privileged access, while Annex A 8.2 goes further on privileged access, including how such rights are allocated and how their use is controlled.
ASD Essential Eight: 3 mappings
This control partially overlaps E8-RA-ML1.1.
IT.PRO-12.1 requires access privileges to be periodically reviewed and updated to match current roles, duties and business requirements; E8-RA-ML1.1 requires privileged access requests to be validated when first requested, the initial check that periodic reviews then build on.
This control partially overlaps E8-RA-ML2.1.
IT.PRO-12.1 requires access privileges to be periodically reviewed and updated to match current roles, duties and business requirements; E8-RA-ML2.1 requires privileged access to be disabled after 12 months unless revalidated, a specific periodic review cycle for privileged access.
This control partially overlaps E8-RA-ML3.1.
IT.PRO-12.1 requires access privileges to be periodically reviewed and updated to match current roles, duties and business requirements; E8-RA-ML3.1 limits privileged access to what users and services need for their duties, the outcome those reviews maintain.
ASD Information Security Manual: 1 mapping
This control partially overlaps ISM-1852.
IT.PRO-12.1 requires access privileges to be periodically reviewed and updated to match current roles, duties and business requirements; ISM-1852 limits unprivileged access to what users need for their duties or functions, the outcome those reviews maintain.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.