Essential Eight RA-ML2.1 Disable privileged access after 12 months without revalidation
What it says
Privileged access to systems, applications and data repositories is disabled after 12 months unless revalidated.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure privileged access is reviewed and renewed annually for continued access.
This control ensures that people with special access to your computer systems regularly prove they still need it. If someone's access isn't reviewed and confirmed every year, it should be turned off. This matters because keeping tabs on who has special access helps stop bad actors from sneaking in unnoticed.
Free. Save your status, tasks and notes.
Why it matters
Not disabling privileged access after 12 months without revalidation increases the risk of misuse by former staff and unauthorised privileged activity.
How to implement
IT team should set up a tracking system to monitor when privileged access was last reviewed for all accounts.
They can use a spreadsheet or specialised software to track this information.
Security officer should define a process for reviewing and renewing privileged access each year.
This could involve sending reminders to supervisors for revalidation of access rights.
System administrator should regularly check user access logs to ensure that privileged access is disabled if not reviewed after 12 months.
They can automate this check with software that flags accounts needing revalidation.
HR department should notify IT of any significant staff changes, such as departures or role shifts, to trigger an immediate review of their privileged access.
Security manager should train staff on the importance of access reviews for privileged accounts and include this training in onboarding and annual refreshers.
Keep it running
Perform an annual privileged access revalidation; automatically disable privileged accounts that are not revalidated by the 12-month deadline and record approvals.
Evidence and audit
- Check 1 of 3What an auditor asks for
Ask for
How do you ensure privileged access is reviewed annually?
Look at
Check the list of user accounts and review records of access validation.
Good evidence
The organisation provides a documented schedule and records showing annual review and approval dates for each account with privileged access.
- Check 2 of 3What an auditor asks for
Ask for
What happens if privileged access is not revalidated after 12 months?
Look at
Examine the policy documents that describe the procedure.
Good evidence
The policy states that privileged access is automatically disabled if not revalidated within 12 months.
- Check 3 of 3What an auditor asks for
Ask for
How does the organisation track the last review date for privileged accounts?
Look at
Request access to the tracking system or logs that show review dates.
Good evidence
There is a clear tracking system in place, showing review dates with alerts for accounts that need revalidation.
Mappings
Closest match in ASD Information Security Manual: ISM-1647, Disable privileged access after 12 months, which asks for the same thing.
ISO/IEC 27001: 3 mappings
This control partially meets A.5.15.
Annex A 5.15 requires access control policies and procedures that define who may access information and systems and under what conditions. E8-RA-ML2.1 sets a specific lifecycle rule for privileged access: disabling it after 12 months unless revalidated. This is a targeted access review/recertification requirement that sits within the broader access governance expectations of Annex A 5.15.
This control partially meets A.5.18.
E8-RA-ML2.1 requires privileged access to be disabled after 12 months unless revalidated. Annex A 5.18 requires access rights to be provisioned, reviewed, modified, and removed in accordance with the organisation's access control policy, which includes periodic review and removal of access. E8-RA-ML2.1 is a specific, time-bound implementation detail for privileged access review/removal within the broader access-rights lifecycle required by Annex A 5.18.
This control partially meets A.8.2.
E8-RA-ML2.1 requires privileged access to be disabled after 12 months unless revalidated. Annex A 8.2 requires privileged access rights to be restricted and managed, covering governance and operational controls for allocation and use of privileged rights. E8-RA-ML2.1 is one concrete management practice (periodic revalidation/expiry) within the broader privileged access management expectations of Annex A 8.2.
ASD Information Security Manual: 6 mappings
This control is equivalent to ISM-1647.
E8-RA-ML2.1 requires privileged access to be disabled after 12 months unless it is revalidated. ISM-1647 states the same requirement for privileged access to systems and their resources being disabled after 12 months unless revalidated. The scope, trigger (12 months), and mandated action (disable unless revalidated) align closely.
This control partially overlaps ISM-1507.
ISM-1507 requires privileged access requests to be validated when first requested, ensuring initial approval is legitimate and authorised. E8-RA-ML2.1 requires privileged access to be disabled after 12 months unless revalidated, which is a periodic re-approval mechanism. They overlap in the concept of validating entitlement, but ISM-1507 is upfront verification while E8-RA-ML2.1 is lifecycle revalidation and expiry control.
This control partially overlaps ISM-1843.
ISM-1843 requires an annual review of AD accounts with unconstrained delegation and removal where there is no SPN or business requirement. E8-RA-ML2.1 requires privileged access to be disabled after 12 months unless revalidated, which is also a periodic revalidation concept applied to privileged access. The overlap is the cadence-driven revalidation/removal of unnecessary high-risk permissions, but ISM-1843 is specifically about Kerberos unconstrained delegation on AD accounts (and checks for SPNs), whereas E8-RA-ML2.1 is broader and not AD-delegation-specific.
This control partially overlaps ISM-1934.
ISM-1934 requires that DCSync permissions are reviewed at least every six months and removed when no longer needed. E8-RA-ML2.1 requires privileged access to systems, applications and data repositories to be disabled after 12 months unless revalidated, which is also a periodic revalidation/removal mechanism for privileged access. They overlap on the principle of time-bound privileged access with periodic review, but ISM-1934 is more specific (DCSync replication permissions) and more frequent (six months), while E8-RA-ML2.1 is broader across privileged access and uses a 12-month threshold.
This control supports ISM-1649.
E8-RA-ML2.1 requires privileged access to be disabled after 12 months unless revalidated. ISM-1649 requires just-in-time administration for system administration, which supports reducing standing privileged access and therefore reduces the number of accounts requiring annual revalidation. ISM-1649 does not enforce a 12-month disablement rule, but it complements E8-RA-ML2.1 by limiting persistent privileged entitlements.
This control depends on ISM-1508.
ISM-1508 requires privileged access to remain limited to what duties require, implying ongoing alignment of privilege with role. E8-RA-ML2.1 supports ISM-1508 by enforcing periodic revalidation and disabling privileged access that is no longer justified, reducing privilege creep. E8-RA-ML2.1 is time/review cadence specific, while ISM-1508 states the overarching least-privilege requirement.
ASD Essentials for enterprise IT: 2 mappings
- IT.PRO-12.1Periodically review and update access privileges to match current roles and dutiesPartially overlaps
This control partially overlaps IT.PRO-12.1.
IT.PRO-12.1 requires access privileges to be periodically reviewed and updated to match current roles, duties and business requirements; E8-RA-ML2.1 requires privileged access to be disabled after 12 months unless revalidated, a specific periodic review cycle for privileged access.
This control partially overlaps IT.PRO-13.1.
IT.PRO-13.1 requires default and unused accounts to be regularly identified and disabled or removed; E8-RA-ML2.1 requires privileged access to systems, applications and data repositories to be disabled after 12 months unless revalidated, a related periodic clean-up.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.