Essential Eight RA-ML3.2 Use secure admin workstations for administrative tasks
What it says
Secure Admin Workstations are used in the performance of administrative activities.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishConduct admin activities on secure, dedicated workstations only.
This control is all about making sure that people who manage and oversee important computer systems do their work on special, secure computers. It's crucial because if these administrative tasks are done on regular, less secure computers, there is a greater risk that malicious software or hackers could access and take control of these sensitive systems.
Free. Save your status, tasks and notes.
Why it matters
Without secure admin workstations, attackers can hijack admin sessions during privileged tasks, enabling domain-wide compromise and rapid lateral movement.
How to implement
The IT team should set up dedicated admin workstations by selecting computers with the latest security features and no unnecessary software installed.
System administrators should ensure these workstations are only used for administrative tasks by configuring network permissions that prevent non-admin tasks.
Security officers should regularly update the security software on these admin workstations through automated patches to keep them secure from known vulnerabilities.
IT support staff should provide training for administrative staff on how to use these dedicated workstations effectively and safely, including guidance on recognising phishing attempts.
The IT team should monitor the network to ensure that these admin workstations are not being used for other purposes, like browsing the web or checking personal emails.
Keep it running
Confirm admin workstations are dedicated and isolated from user networks; regularly validate hardening, patching and application controls to prevent configuration drift.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
Are there dedicated secure workstations set up for administrative tasks?
Look at
Examine the asset inventory or network diagram to identify the machines designated as secure admin workstations.
Good evidence
There should be a clear list and physical or digital distinction of machines used solely for administrative activities, supported by documentation.
- Check 2 of 2What an auditor asks for
Ask for
How is the security of these workstations maintained and updated?
Look at
Review logs of security updates and patch management records for these specific workstations.
Good evidence
Regular and recent updates are applied, with records showing a consistent schedule of patch management.
Mappings
Closest match in ASD Information Security Manual: ISM-1898, Use secure admin workstations for administration, which asks for the same thing.
ASD Information Security Manual: 7 mappings
This control is equivalent to ISM-1898.
ISM-1898 requires Secure Admin Workstations to be used when performing administrative activities to reduce exposure of privileged actions and credentials. E8-RA-ML3.2 states the same requirement: administrators perform admin tasks using Secure Admin Workstations. Both controls align in intent, scope, and implementation outcome, with only framework phrasing differences.
This control partially overlaps ISM-1385.
E8-RA-ML3.2 requires administrative activities to be performed only from Secure Admin Workstations (SAWs). ISM-1385 requires administrative infrastructure to be segregated from the wider network and the internet, which materially strengthens the security posture of SAWs and privileged administration workflows. The controls address different layers (endpoint usage vs network/infrastructure segregation), but ISM-1385 helps make the SAW model in E8-RA-ML3.2 effective in practice.
This control partially overlaps ISM-1387.
ISM-1387 requires that administrative activities are conducted through jump servers. E8-RA-ML3.2 requires administrative tasks be performed from Secure Admin Workstations, which can be the endpoint used to access a jump server and reduces the likelihood of admin credential compromise. The candidate focuses on the security posture of the admin workstation, while ISM-1387 focuses on the network/architecture pattern of brokering admin access via a jump server.
This control partially overlaps ISM-1731.
ISM-1731 requires remediation planning and coordination to occur on trusted systems that are separate from the compromised environment. E8-RA-ML3.2 mandates using Secure Admin Workstations for administrative activities, which can serve as the trusted, segregated platform from which remediation actions are coordinated and executed. The overlap is the use of hardened, trusted endpoints, but E8-RA-ML3.2 is broader across all admin tasks while ISM-1731 is specifically about intrusion remediation coordination in response to compromise.
This control partially overlaps ISM-1750.
E8-RA-ML3.2 requires privileged administration to be performed from Secure Admin Workstations, separating admin activity from general user computing environments. ISM-1750 requires segregation of administrative infrastructure between critical, high-value and regular servers, which aligns with the same principle of separating privileged administration to reduce lateral movement and blast radius. ISM-1750 is focused on server/admin infrastructure segmentation, while E8-RA-ML3.2 is focused on the secure endpoint used by administrators.
This control depends on ISM-0843.
E8-RA-ML3.2 requires administrative activities to be performed only from Secure Admin Workstations (SAWs) to reduce exposure to malware and user browsing risks. ISM-0843 requires application control on workstations, which is a common foundational hardening measure typically necessary to qualify a workstation as a SAW. ISM-0843 can apply to all workstations, whereas E8-RA-ML3.2 is specifically about restricting privileged work to the dedicated secure endpoint.
This control depends on ISM-1406.
E8-RA-ML3.2 requires administrative activities to be performed only from Secure Admin Workstations (dedicated, hardened endpoints). ISM-1406 supports the creation and maintenance of such hardened endpoints by requiring Standard Operating Environments (SOEs) for workstations and servers. E8-RA-ML3.2 is about where/admin task segregation, while ISM-1406 is about baseline build standardisation across endpoints rather than admin-only usage.
ASD Essentials for enterprise IT: 2 mappings
- IT.PRO-05.1Restrict administration to dedicated, hardened environments isolated from unprivileged user workloadsPartially overlaps
This control partially overlaps IT.PRO-05.1.
IT.PRO-05.1 requires administration to happen only in dedicated, hardened environments isolated from unprivileged user workloads; E8-RA-ML3.2 requires Secure Admin Workstations to be used for administrative activities, a specific form of that dedicated environment.
- IT.PRO-07.2Restrict administrative and management tools to approved sets and authorised locationsPartially overlaps
This control partially overlaps IT.PRO-07.2.
IT.PRO-07.2 requires admin and management tooling to be limited to approved software run from authorised, known locations; E8-RA-ML3.2 requires Secure Admin Workstations to be used for administrative activities, so the two overlap on controlling where administration happens.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.