Essential Eight RA-ML2.2 Privileged access is disabled after 45 days of inactivity
What it says
Privileged access to systems and applications is disabled after 45 days of inactivity.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishDisable admin accounts if unused for 45 days to improve security.
This control is about ensuring that admin accounts don't sit around unused for too long. If an administrator hasn't used their access for 45 days, their account should be turned off. This is important because old admin accounts could be a way in for hackers if they aren't managed properly.
Free. Save your status, tasks and notes.
Why it matters
If privileged accounts remain enabled beyond 45 days of inactivity, attackers can exploit forgotten admin credentials to gain elevated access and persist undetected.
How to implement
The IT team should regularly review activity logs to identify inactive admin accounts.
Use automated tools to help track usage and alert when accounts have been inactive for 45 days.
The system administrator needs to disable unused admin accounts.
Configure systems to automatically disable accounts after 45 days of inactivity as a preventive measure.
The security officer should establish a policy for managing admin account inactivity.
Develop guidelines on how accounts should be reviewed, disabled, and reactivated if needed.
The IT support staff should train administrators on the policy.
Explain the importance of regularly using their accounts or notifying IT if access is no longer needed.
Keep it running
Set up alerts for privileged accounts approaching 45 days inactivity, then automatically disable access (or require reauthorisation) and record actions for audit.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
How does the organisation monitor admin account activity?
Look at
Examine activity logs or reports that show admin account usage over time.
Good evidence
Logs show consistent monitoring and actions taken once inactivity exceeds 45 days.
- Check 2 of 2What an auditor asks for
Ask for
What is the process for disabling inactive admin accounts?
Look at
Review system configurations or policies that describe the automatic disabling process.
Good evidence
Policies and system settings that detail the criteria and actions for account disabling.
Mappings
Closest match in ASD Information Security Manual: ISM-1648, Disabling inactive privileged access to systems, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.2.
E8-RA-ML2.2 requires privileged access to be disabled after 45 days of inactivity. Annex A 8.2 requires organisations to restrict and manage the allocation and use of privileged access rights across their lifecycle. Disabling inactive privileged access in E8-RA-ML2.2 is one specific privileged access management practice that supports meeting the broader governance intent of Annex A 8.2.
ASD Information Security Manual: 2 mappings
This control is equivalent to ISM-1648.
E8-RA-ML2.2 requires privileged access to systems and applications to be disabled after 45 days of inactivity. ISM-1648 states the same requirement for privileged access to systems and their resources being disabled after 45 days of inactivity. The intent, trigger condition (inactivity), and timeframe (45 days) align closely, making the controls effectively interchangeable in practice.
This control partially overlaps ISM-1647.
E8-RA-ML2.2 requires privileged access to be disabled after 45 days of inactivity. ISM-1647 also requires disabling privileged access, but uses a different trigger and timeframe (after 12 months unless revalidated) rather than inactivity-based disabling at 45 days. They overlap on the objective of removing unnecessary privileged access, but differ materially in cadence and the mechanism (inactivity vs revalidation window).
ASD Essentials for enterprise IT: 1 mapping
This control partially overlaps IT.PRO-13.1.
IT.PRO-13.1 requires default and unused accounts to be regularly identified and disabled or removed; E8-RA-ML2.2 requires privileged access to systems and applications to be disabled after 45 days of inactivity, a specific case of disabling unused privileged access.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.