Essential Eight RA-ML2.2Privileged access is disabled after 45 days of inactivity
Official control statement
Privileged access to systems and applications is disabled after 45 days of inactivity.
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
Disable admin accounts if unused for 45 days to improve security.
What this means in practice
This control is about ensuring that admin accounts don't sit around unused for too long. If an administrator hasn't used their access for 45 days, their account should be turned off. This is important because old admin accounts could be a way in for hackers if they aren't managed properly.
Framework
ASD Essential Eight
Control effect (Control Stack)
Preventative
E8 mitigation strategy
Restrict admin privileges
Classifications
N/A
Official last update
N/A
Control Stack last updated
29 Sept 2026
E8 maturity levels
ML2
Why it matters
If privileged accounts remain enabled beyond 45 days of inactivity, attackers can exploit forgotten admin credentials to gain elevated access and persist undetected.
Operational notes
Set up alerts for privileged accounts approaching 45 days inactivity, then automatically disable access (or require reauthorisation) and record actions for audit.
Implementation tips
- The IT team should regularly review activity logs to identify inactive admin accounts. Use automated tools to help track usage and alert when accounts have been inactive for 45 days.
- The system administrator needs to disable unused admin accounts. Configure systems to automatically disable accounts after 45 days of inactivity as a preventive measure.
- The security officer should establish a policy for managing admin account inactivity. Develop guidelines on how accounts should be reviewed, disabled, and reactivated if needed.
- The IT support staff should train administrators on the policy. Explain the importance of regularly using their accounts or notifying IT if access is no longer needed.
Audit / evidence tips
- AskHow does the organisation monitor admin account activity?
- Look atExamine activity logs or reports that show admin account usage over time
- GoodLogs show consistent monitoring and actions taken once inactivity exceeds 45 days
- AskWhat is the process for disabling inactive admin accounts?
- Look atReview system configurations or policies that describe the automatic disabling process
- GoodPolicies and system settings that detail the criteria and actions for account disabling
Cross-framework mappings
How E8-RA-ML2.2 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
layersPartially meets(1)expand_less | ||
| Annex A 8.2 | E8-RA-ML2.2 requires privileged access to be disabled after 45 days of inactivity | |
ASD ISM
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related Essential 8 controls in Restrict admin privileges
See all Restrict admin privileges controls, or browse the full ASD Essential Eight library.