Essential Eight RA-ML3.3Just-in-time administration is used for administering systems and applications.
Official control statement
Just-in-time administration is used for administering systems and applications.
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
Grant high-level access only when needed and for limited times to enhance security.
What this means in practice
Just-in-time administration means giving people access to important parts of the system only when they really need it and for a short time. This is crucial because if someone gets full-time access, a hacker could also sneak in and cause damage, like stealing sensitive data or disrupting business operations.
Framework
ASD Essential Eight
Control effect (Control Stack)
Preventative
E8 mitigation strategy
Restrict admin privileges
Classifications
N/A
Official last update
N/A
Control Stack last updated
29 Sept 2026
E8 maturity levels
ML3
Why it matters
Without just-in-time access, persistent admin privileges create a large attack surface, giving intruders lasting control if an admin account is compromised.
Operational notes
Implement time-bound admin elevation (with approval where needed) and auto-expire privileges after tasks; log and alert on each just-in-time activation for visibility.
Implementation tips
- System administrator should grant temporary access only when specific tasks need to be done by creating an access request each time.
- IT team should monitor access requests and ensure they are only approved by a manager when there's a justified need.
- Security officer should set up automatic expiration of access rights after a predetermined period to ensure they don't remain active longer than necessary.
- IT team should use software tools to track and log every time someone is granted elevated access and make sure it's for legitimate purposes.
- System administrator should ensure that the access provided is limited to the minimum level required for a task to prevent unnecessary exposure.
Audit / evidence tips
- AskHow do you ensure that administrative access is granted only temporarily?
- Look atExamine the logs of access requests and approvals for time-limited permissions
- GoodLogs show each request is tied to a specific task and has been approved for a set duration by a manager
- AskHow do you check if all elevated access rights are appropriately revoked after use?
- Look atReview system settings that automatically revoke permissions
- GoodSystem settings show automatic expiration of elevated access after task completion or within a set timeframe
Cross-framework mappings
How E8-RA-ML3.3 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
layersPartially meets(3)expand_less | ||
| Annex A 5.15 | Annex A 5.15 requires rules and procedures to control access to information and systems based on business and security requirements | |
| Annex A 5.18 | E8-RA-ML3.3 requires implementing just-in-time administration so privileged access is only granted when required and expires after a limi... | |
| Annex A 8.2 | E8-RA-ML3.3 requires JIT administration, a specific method for controlling the allocation and use of privileged access by making it time-... | |
ASD ISM
| Control | Notes | Details |
|---|---|---|
equalEquivalent(1)expand_less | ||
| ISM-1649 | E8-RA-ML3.3 requires just-in-time (JIT) administration to be used when administering systems and applications, limiting high-level access... | |
sync_altPartially overlaps(2)expand_less | ||
| ISM-0445 | ISM-0445 requires privileged users to be issued a dedicated privileged account used only for privileged duties | |
| ISM-1508 | E8-RA-ML3.3 requires JIT administration so privileged access is only granted when required and for limited durations | |
handshakeSupports(2)expand_less | ||
| ISM-1927 | ISM-1927 requires limiting access to key Microsoft identity servers (AD DS/CS/FS and Entra Connect) to privileged users who need it | |
| ISM-1939 | ISM-1939 requires that organisations minimise the number of accounts in highly privileged groups (e.g | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related Essential 8 controls in Restrict admin privileges
See all Restrict admin privileges controls, or browse the full ASD Essential Eight library.