Essential Eight RA-ML1.7 Prevent privileged user accounts from logging on to unprivileged environments
What it says
Privileged user accounts (excluding local administrator accounts) cannot logon to unprivileged operating environments.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure privileged accounts can't be used in unsecured setups to limit risk.
This control ensures that accounts with special privileges can't be used in unsafe situations. Imagine having a special key to your business; if you use it in a risky area or environment, someone could copy it and use it to break into your business. This control stops privileged accounts from being used in unprotected environments, which can prevent potential security breaches.
Free. Save your status, tasks and notes.
Why it matters
Using privileged accounts in unsecured environments risks exposing credentials to malware, enabling attackers to escalate access and compromise systems.
How to implement
IT team should identify all privileged accounts in the organisation by reviewing user account permissions and categorising them according to their level of access.
System administrators should configure systems to prevent privileged accounts from logging into unprivileged environments.
This can be achieved by setting up access restrictions in the system's access control settings.
Security officers should regularly review and update policies to ensure they reflect the separation between privileged and unprivileged environments.
This can be done by documenting procedures that detail these access restrictions.
IT security staff should implement a monitoring system to alert when a privileged account attempts to access an unprivileged environment.
This could involve setting up alerts within existing security software to track login attempts.
Keep it running
Enforce logon restrictions so privileged accounts cannot access unprivileged workstations; review logs and alert on any blocked sign-in attempts.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
Are privileged accounts restricted from logging into unprivileged environments?
Look at
Review system logs and access control configurations that show login attempts by privileged accounts.
Good evidence
System logs and settings show that privileged accounts are unable to access unprivileged environments, with proper restrictions documented.
- Check 2 of 2What an auditor asks for
Ask for
Is there documentation explaining how privileged access is controlled and monitored?
Look at
Examine the organisational policies and procedures regarding privileged account management.
Good evidence
There is clear documentation outlining the procedures for managing privileged access, including a list of authorised users and system configurations.
Mappings
Closest match in ASD Information Security Manual: ISM-1689, Block privileged account logons to unprivileged operating environments, which asks for the same thing.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.15.
Annex A 5.15 requires rules and procedures to control logical access to systems and information based on requirements. E8-RA-ML1.7 requires preventing privileged accounts from logging into unprivileged operating environments, reducing credential exposure and enforcing separation of duties. This is a narrow technical rule under the broader governance expectation of Annex A 5.15.
This control partially meets A.8.2.
E8-RA-ML1.7 requires a specific restriction: privileged accounts (excluding local administrator accounts) cannot log on to unprivileged operating environments. ISO/IEC 27001:2022 Annex A 8.2 requires that privileged access rights are allocated and used in a restricted and managed manner, covering broader governance and controls for privileged access. E8-RA-ML1.7 is one concrete technical restriction that would support compliance with Annex A 8.2, but Annex A 8.2 extends beyond logon context to cover the overall management of privileged rights.
ASD Information Security Manual: 7 mappings
This control is equivalent to ISM-1689.
E8-RA-ML1.7 requires that privileged accounts (excluding local administrator accounts) cannot logon to unprivileged operating environments. ISM-1689 states the same restriction with the same exception, directly matching the intent and implementation outcome. Both controls are specifically about preventing privileged credential use in lower-trust environments to reduce credential theft and lateral movement risk.
This control partially overlaps ISM-1508.
ISM-1508 requires that privileged accounts only have and use the access necessary to perform assigned duties. E8-RA-ML1.7 relates by restricting where privileged accounts can log on, reducing exposure by preventing use in unprivileged environments that are more likely to be compromised. E8-RA-ML1.7 is environment-segregation focused, whereas ISM-1508 is broader and covers what rights are granted on systems and resources.
This control partially overlaps ISM-1688.
ISM-1688 mandates the prevention of unprivileged accounts accessing privileged environments, while E8-RA-ML1.7 prevents privileged accounts from accessing unprivileged environments. Both involve tier separation through logon restrictions but address distinct directions.
This control partially overlaps ISM-1827.
ISM-1827 requires dedicated domain administrator accounts for administering AD DS domain controllers, separated from accounts used to administer other systems. E8-RA-ML1.7 restricts where privileged accounts can log on by preventing privileged accounts from accessing unprivileged environments, which reduces exposure of those dedicated admin credentials. ISM-1827 focuses on account separation by system/admin purpose, while E8-RA-ML1.7 focuses on logon boundary enforcement regardless of whether accounts are dedicated.
- ISM-1958Block DCSync-permitted accounts from logging on to unprivileged environmentsPartially overlaps
This control partially overlaps ISM-1958.
E8-RA-ML1.7 requires privileged accounts (excluding local administrator accounts) cannot logon to unprivileged environments. ISM-1958 applies the same type of restriction but only to highly privileged accounts with DCSync permissions. ISM-1958 is more specific to Active Directory replication-privileged identities, whereas E8-RA-ML1.7 applies broadly to privileged accounts generally.
This control supports ISM-0445.
ISM-0445 requires dedicated privileged accounts to be used only for duties requiring privileged access. E8-RA-ML1.7 complements this by preventing privileged accounts from logging on to unprivileged operating environments, helping ensure the dedicated privileged account is not used for routine activity. ISM-0445 mandates account separation, whereas E8-RA-ML1.7 enforces where that privileged account may be used.
- ISM-1380Privileged users work in separate privileged and unprivileged operating environmentsSupports
This control supports ISM-1380.
E8-RA-ML1.7 requires preventing privileged accounts (excluding local administrator accounts) from logging on to unprivileged operating environments. ISM-1380 supports this by requiring privileged users to use separate privileged and unprivileged operating environments, making the E8-RA-ML1.7 logon restriction practical and enforceable. ISM-1380 is broader in operating model design, while E8-RA-ML1.7 is a specific access/logon prohibition.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-05.1Restrict administration to dedicated, hardened environments isolated from unprivileged user workloadsPartially overlaps
This control partially overlaps IT.PRO-05.1.
IT.PRO-05.1 requires administration to happen only in dedicated, hardened environments isolated from unprivileged user workloads; E8-RA-ML1.7 stops privileged accounts, other than local administrator accounts, logging on to unprivileged operating environments, enforcing that isolation.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.