Essential Eight RA-ML1.2 Dedicated privileged user accounts for privileged duties
What it says
Privileged users are assigned a dedicated privileged user account to be used solely for duties requiring privileged access.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure admins use special accounts only for their admin work.
This control means that people who have extra powers to change important parts of an organisation's computer systems use special accounts only for those tasks. This is important because if they used the same account for everything, like checking email or browsing the web, it would be easier for cybercriminals to trick them and gain control over the organisation's critical systems.
Free. Save your status, tasks and notes.
Why it matters
Without separate privileged accounts, a phished standard login can be reused for admin actions, enabling rapid escalation and system takeover.
How to implement
The IT manager should ensure that all administrators have two separate accounts: one with special privileges and one without, used only for regular tasks.
System administrators must create a list of all people who need privileged accounts and set up these accounts using their existing identity management system.
The security officer should train administrators on why they need to use their privileged accounts only for special tasks and how to switch between accounts safely.
The IT team should monitor account usage regularly to ensure privileged accounts are only used for administrative purposes and not for everyday activities like email or web browsing.
Keep it running
Maintain separate privileged accounts; review membership and logons, and alert on privileged use from standard accounts or outside admin workflows.
Evidence and audit
- Check 1 of 3What an auditor asks for
Ask for
Are privileged accounts separate from everyday user accounts?
Look at
Review the account listings in the user management system for evidence of distinct privileged accounts.
Good evidence
Each user requiring special system access has a clearly marked privileged account, separate from their everyday account.
- Check 2 of 3What an auditor asks for
Ask for
Are there records showing privileged accounts are only used for administrative tasks?
Look at
Examine system logs and usage reports.
Good evidence
Logs indicate privileged accounts access only administrative areas and tools, distinct from general user activities.
- Check 3 of 3What an auditor asks for
Ask for
How are employees educated on the use of privileged accounts?
Look at
Check for training documentation or attendance records of training sessions.
Good evidence
Documented sessions and materials, showing all administrators have been trained on the proper use of privileged accounts.
Mappings
Closest match in ASD Information Security Manual: ISM-0445, Dedicated privileged accounts used solely for privileged duties, which asks for the same thing.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.15.
Annex A 5.15 requires organisations to define and apply access control rules and procedures, including controls over privileged access. E8-RA-ML1.2 requires dedicated privileged accounts for admin tasks, which is a specific account management rule that operationalises separation and control of privileged access. The candidate is narrower because it prescribes one privileged access mechanism rather than the full set of access control policies and procedures required by Annex A 5.15.
This control partially meets A.8.2.
E8-RA-ML1.2 requires a specific administrative practice: privileged users must use separate dedicated privileged accounts only for privileged tasks. ISO/IEC 27001:2022 Annex A 8.2 requires privileged access rights to be allocated, used, restricted and managed, which is broader governance over privileged access. E8-RA-ML1.2 is one concrete mechanism that helps satisfy the broader privileged access management expectations in Annex A 8.2.
ASD Information Security Manual: 11 mappings
This control is equivalent to ISM-0445.
E8-RA-ML1.2 requires privileged users to have a dedicated privileged account used solely for tasks requiring privileged access. ISM-0445 states the same requirement, explicitly mandating dedicated privileged user accounts solely for privileged duties. The scope and intent align closely, so implementing one would largely satisfy the other.
This control is broader than ISM-1949.
ISM-1949 requires Microsoft AD FS servers to be administered using a dedicated service account that is not used to administer other systems. E8-RA-ML1.2 similarly requires privileged users to have dedicated privileged accounts used solely for privileged duties, aligning with the dedicated-account principle. ISM-1949 is a specific application for AD FS administration and emphasises non-reuse across other systems, while E8-RA-ML1.2 is broader across all privileged administration.
This control partially meets ISM-1263.
E8-RA-ML1.2 requires a dedicated privileged account be used only for duties requiring privileged access. ISM-1263 narrows this by requiring unique privileged user accounts for administering individual server applications. ISM-1263 goes deeper into per-application administrative separation, which is a specific way to implement E8-RA-ML1.2.
This control partially meets ISM-1827.
E8-RA-ML1.2 requires privileged users to use dedicated privileged accounts solely for admin tasks. ISM-1827 applies this concept specifically to administering Microsoft AD DS domain controllers using dedicated domain administrator accounts not used elsewhere. ISM-1827 is a system-specific instantiation of the broader E8-RA-ML1.2 requirement.
This control partially overlaps ISM-1508.
E8-RA-ML1.2 requires privileged users to use dedicated privileged accounts solely for privileged duties. ISM-1508 requires that privileged access is limited to what is necessary for duties (least privilege), which often pairs with using separate admin accounts to reduce over-privileged day-to-day sessions. ISM-1508 focuses on the level/scope of privileges granted, while E8-RA-ML1.2 focuses on account separation and how privileged access is used.
This control partially overlaps ISM-2133.
ISM-2133 requires AI agents to use unique identities that are not personnel accounts and are not shared across agents. ASD Essential Eight E8-RA-ML1.2 requires privileged users to have dedicated privileged accounts for admin tasks, enforcing separation between identities used for different purposes to improve accountability and reduce misuse. Both controls implement an anti-sharing/separation principle for traceability, but E8-RA-ML1.2 is focused on human privileged administration rather than non-human agent identity uniqueness.
This control supports ISM-1175.
ISM-1175 requires privileged user accounts to be prevented from accessing the internet, email and web services unless explicitly authorised. E8-RA-ML1.2 supports this by separating admin activity into dedicated privileged accounts, making it feasible to apply internet/email/web restrictions to the privileged account while allowing the user's standard account to access online services as needed. E8-RA-ML1.2 is about account structure, while ISM-1175 is about enforcing network/service access restrictions for privileged accounts.
This control supports ISM-1620.
E8-RA-ML1.2 requires privileged users to perform admin work using dedicated privileged accounts rather than their standard accounts. ISM-1620 strengthens that outcome by requiring privileged accounts to be placed into the Active Directory Protected Users group, hardening how those accounts authenticate and are used. ISM-1620 is about securing the privileged account configuration, whereas E8-RA-ML1.2 is about account separation and appropriate usage.
This control depends on ISM-0414.
ISM-0414 requires unique identification of users with system access for accountability. E8-RA-ML1.2 enhances this by requiring privileged users to have dedicated accounts, improving traceability of administrative actions to individuals, within their role.
This control depends on ISM-1927.
ISM-1927 requires restricting access to domain controllers and related identity servers to only those privileged users who require it. E8-RA-ML1.2 supports this by requiring privileged users to use dedicated privileged accounts for administrative duties, which makes it easier to enforce and audit who can access identity servers. E8-RA-ML1.2 does not itself restrict which systems can be accessed, whereas ISM-1927 sets a specific restriction for identity server access.
This control depends on ISM-1958.
ISM-1958 requires blocking DCSync-permitted accounts from logging on to unprivileged environments to reduce credential exposure pathways. E8-RA-ML1.2 requires dedicated privileged accounts for administrative tasks, which supports implementing ISM-1958 by separating high-privilege identities from day-to-day user logons and making logon restrictions easier to enforce. E8-RA-ML1.2 is about account separation, while ISM-1958 is about technical logon denial based on DCSync privilege.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-12.3Provision user, administrative and non-person accounts with minimum required privilegesPartially overlaps
This control partially overlaps IT.PRO-12.3.
IT.PRO-12.3 requires user, administrative and non-person accounts to be provisioned with only the minimum access and privileges they need; E8-RA-ML1.2 gives privileged users a dedicated privileged account used solely for privileged duties, a related rule for administrative accounts.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.