Essential Eight RA-ML1.2Dedicated privileged user accounts for privileged duties
Official control statement
Privileged users are assigned a dedicated privileged user account to be used solely for duties requiring privileged access.
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
Ensure admins use special accounts only for their admin work.
What this means in practice
This control means that people who have extra powers to change important parts of an organisation's computer systems use special accounts only for those tasks. This is important because if they used the same account for everything, like checking email or browsing the web, it would be easier for cybercriminals to trick them and gain control over the organisation's critical systems.
Framework
ASD Essential Eight
Control effect (Control Stack)
Preventative
E8 mitigation strategy
Restrict admin privileges
Classifications
N/A
Official last update
N/A
Control Stack last updated
29 Sept 2026
E8 maturity levels
ML1
Why it matters
Without separate privileged accounts, a phished standard login can be reused for admin actions, enabling rapid escalation and system takeover.
Operational notes
Maintain separate privileged accounts; review membership and logons, and alert on privileged use from standard accounts or outside admin workflows.
Implementation tips
- The IT manager should ensure that all administrators have two separate accounts: one with special privileges and one without, used only for regular tasks.
- System administrators must create a list of all people who need privileged accounts and set up these accounts using their existing identity management system.
- The security officer should train administrators on why they need to use their privileged accounts only for special tasks and how to switch between accounts safely.
- The IT team should monitor account usage regularly to ensure privileged accounts are only used for administrative purposes and not for everyday activities like email or web browsing.
Audit / evidence tips
- AskAre privileged accounts separate from everyday user accounts?
- Look atReview the account listings in the user management system for evidence of distinct privileged accounts
- GoodEach user requiring special system access has a clearly marked privileged account, separate from their everyday account
- AskAre there records showing privileged accounts are only used for administrative tasks?
- Look atExamine system logs and usage reports
- GoodLogs indicate privileged accounts access only administrative areas and tools, distinct from general user activities
- AskHow are employees educated on the use of privileged accounts?
- Look atCheck for training documentation or attendance records of training sessions
- GoodDocumented sessions and materials, showing all administrators have been trained on the proper use of privileged accounts
Cross-framework mappings
How E8-RA-ML1.2 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
layersPartially meets(2)expand_less | ||
| Annex A 5.15 | Annex A 5.15 requires organisations to define and apply access control rules and procedures, including controls over privileged access | |
| Annex A 8.2 | E8-RA-ML1.2 requires a specific administrative practice: privileged users must use separate dedicated privileged accounts only for privil... | |
ASD ISM
| Control | Notes | Details |
|---|---|---|
equalEquivalent(1)expand_less | ||
| ISM-0445 | E8-RA-ML1.2 requires privileged users to have a dedicated privileged account used solely for tasks requiring privileged access | |
open_in_fullBroader than(1)expand_less | ||
| ISM-1949 | ISM-1949 requires Microsoft AD FS servers to be administered using a dedicated service account that is not used to administer other systems | |
layersPartially meets(2)expand_less | ||
| ISM-1263 | E8-RA-ML1.2 requires a dedicated privileged account be used only for duties requiring privileged access | |
| ISM-1827 | E8-RA-ML1.2 requires privileged users to use dedicated privileged accounts solely for admin tasks | |
sync_altPartially overlaps(2)expand_less | ||
| ISM-1508 | E8-RA-ML1.2 requires privileged users to use dedicated privileged accounts solely for privileged duties | |
| ISM-2133 | ISM-2133 requires AI agents to use unique identities that are not personnel accounts and are not shared across agents | |
handshakeSupports(2)expand_less | ||
| ISM-1175 | ISM-1175 requires privileged user accounts to be prevented from accessing the internet, email and web services unless explicitly authorised | |
| ISM-1620 | E8-RA-ML1.2 requires privileged users to perform admin work using dedicated privileged accounts rather than their standard accounts | |
extensionDepends on(3)expand_less | ||
| ISM-0414 | ISM-0414 requires unique identification of users with system access for accountability | |
| ISM-1927 | ISM-1927 requires restricting access to domain controllers and related identity servers to only those privileged users who require it | |
| ISM-1958 | ISM-1958 requires blocking DCSync-permitted accounts from logging on to unprivileged environments to reduce credential exposure pathways | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related Essential 8 controls in Restrict admin privileges
See all Restrict admin privileges controls, or browse the full ASD Essential Eight library.