Essential Eight RA-ML1.5 Privileged users use separate privileged and unprivileged environments
What it says
Privileged users use separate privileged and unprivileged operating environments.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure privileged users have separate work environments for admin tasks and regular tasks.
This control is about making sure that users with special privileges in an organisation, like IT admins, use different environments for their high-level tasks and everyday tasks. This matters because if these users use the same environment for everything and it gets compromised, attackers could gain access to the entire system and cause a lot of damage.
Free. Save your status, tasks and notes.
Why it matters
If privileged and unprivileged tasks aren't separated, a user compromise can grant attackers admin access, risking entire system control.
How to implement
The IT team should create separate accounts for privileged users.
Use one account solely for administrative tasks and another for general tasks.
System administrators need to set up separate virtual desktops or systems for admin tasks.
This can be done using separate workstations or virtual machines for different types of work.
Security officers should ensure that any privileged account does not have access to general internet browsing, email, or social media to minimise risk of exposure to attacks.
The IT team should regularly review and manage the access permissions of privileged accounts.
Use tools to verify that accounts are only used for their intended purpose.
Keep it running
Use separate admin accounts/workstations for privileged tasks; monitor privileged logons, audit usage, and alert on unapproved access to admin environments.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
Do privileged users have separate accounts for admin and regular tasks?
Look at
Examine the user account configurations to see if there are distinct credentials for different levels of access.
Good evidence
A list showing privileged and unprivileged accounts per user, with clear documentation on their use.
- Check 2 of 2What an auditor asks for
Ask for
Are there separate environments set up for privileged and regular activities?
Look at
Review system configuration or virtual environment setups.
Good evidence
Clear documentation and logs showing separate environments being used by privileged users.
Mappings
Closest match in ASD Information Security Manual: ISM-1380, Privileged users work in separate privileged and unprivileged operating environments, which asks for the same thing.
ASD Information Security Manual: 8 mappings
- ISM-1380Privileged users work in separate privileged and unprivileged operating environmentsEquivalent
This control is equivalent to ISM-1380.
E8-RA-ML1.5 requires privileged users to use separate privileged and unprivileged operating environments to isolate admin activity from day-to-day use. ISM-1380 states the same requirement using essentially identical wording and intent. Both controls focus on environment separation as a core protective measure against credential theft and admin-session compromise.
This control is broader than ISM-1689.
E8-RA-ML1.5 requires privileged users to operate in separate privileged and unprivileged environments. ISM-1689 supports this outcome by enforcing that privileged user accounts cannot log on to unprivileged operating environments, which helps maintain the separation in practice. ISM-1689 is an account logon restriction, while E8-RA-ML1.5 is broader about using distinct operating environments for different task types.
This control is broader than ISM-1958.
E8-RA-ML1.5 requires privileged users to use separate privileged and unprivileged operating environments to reduce exposure of high-value credentials. ISM-1958 supports this by explicitly preventing accounts with DCSync permissions from logging on to unprivileged operating environments, enforcing strong separation for a particularly sensitive privilege set. ISM-1958 is narrower and targeted to DCSync-capable accounts, whereas E8-RA-ML1.5 applies to privileged users generally.
This control partially meets ISM-1635.
ISM-1635 requires system owners to implement controls for each system and its operating environment. E8-RA-ML1.5 requires privileged users to use separate privileged and unprivileged operating environments, which is a specific administrative-environment control that reduces credential theft risk. ISM-1635 is broader because it covers all required controls for the system and environment.
This control partially overlaps ISM-1387.
E8-RA-ML1.5 requires privileged users to use separate privileged and unprivileged operating environments for admin versus standard activities. ISM-1387 overlaps by requiring administrative activities to be conducted through jump servers, which is one common way to provide a separate admin environment and constrain privileged pathways. ISM-1387 focuses on the administrative access path/architecture (jump server), while E8-RA-ML1.5 is technology-agnostic about how the separate environments are achieved.
This control supports ISM-1687.
E8-RA-ML1.5 requires privileged users to use separate privileged and unprivileged operating environments. ISM-1687 supports this by preventing a privileged environment from being virtualised inside an unprivileged environment, reducing the chance the 'separate' admin context is undermined by the host's lower trust level. ISM-1687 is a specific hardening constraint, whereas E8-RA-ML1.5 is the higher-level separation outcome.
This control supports ISM-1688.
ISM-1688 specifies technical prevention for unprivileged account log-ins to privileged environments. E8-RA-ML1.5 requires the segregation of privileged and unprivileged environments, facilitating the enforcement of ISM-1688's logon controls.
This control depends on ISM-0445.
ISM-0445 requires privileged users to use a dedicated privileged account solely for privileged activities. E8-RA-ML1.5 extends this separation by requiring privileged users to use separate privileged and unprivileged operating environments, which reinforces the intent of keeping privileged activity isolated. ISM-0445 is account-focused, while E8-RA-ML1.5 is environment/session segregation-focused.
ASD Essentials for enterprise IT: 2 mappings
- IT.PRO-05.1Restrict administration to dedicated, hardened environments isolated from unprivileged user workloadsPartially overlaps
This control partially overlaps IT.PRO-05.1.
IT.PRO-05.1 requires administration to happen only in dedicated, hardened environments isolated from unprivileged user workloads; E8-RA-ML1.5 requires privileged users to use separate privileged and unprivileged operating environments, the core of that separation.
- IT.PRO-18.2Restrict lateral movement between and within segments to approved pathways and servicesPartially overlaps
This control partially overlaps IT.PRO-18.2.
IT.PRO-18.2 requires lateral movement within and between network segments to be limited to approved pathways by business need and trust; E8-RA-ML1.5 requires privileged users to use separate privileged and unprivileged operating environments, a related separation by privilege level rather than by network segment.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.