Essential Eight RA-ML3.3 Just-in-time administration is used for administering systems and applications.
What it says
Just-in-time administration is used for administering systems and applications.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishGrant high-level access only when needed and for limited times to enhance security.
Just-in-time administration means giving people access to important parts of the system only when they really need it and for a short time. This is crucial because if someone gets full-time access, a hacker could also sneak in and cause damage, like stealing sensitive data or disrupting business operations.
Free. Save your status, tasks and notes.
Why it matters
Without just-in-time access, persistent admin privileges create a large attack surface, giving intruders lasting control if an admin account is compromised.
How to implement
System administrator should grant temporary access only when specific tasks need to be done by creating an access request each time.
IT team should monitor access requests and ensure they are only approved by a manager when there's a justified need.
Security officer should set up automatic expiration of access rights after a predetermined period to ensure they don't remain active longer than necessary.
IT team should use software tools to track and log every time someone is granted elevated access and make sure it's for legitimate purposes.
System administrator should ensure that the access provided is limited to the minimum level required for a task to prevent unnecessary exposure.
Keep it running
Implement time-bound admin elevation (with approval where needed) and auto-expire privileges after tasks; log and alert on each just-in-time activation for visibility.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
How do you ensure that administrative access is granted only temporarily?
Look at
Examine the logs of access requests and approvals for time-limited permissions.
Good evidence
Logs show each request is tied to a specific task and has been approved for a set duration by a manager.
- Check 2 of 2What an auditor asks for
Ask for
How do you check if all elevated access rights are appropriately revoked after use?
Look at
Review system settings that automatically revoke permissions.
Good evidence
System settings show automatic expiration of elevated access after task completion or within a set timeframe.
Mappings
Closest match in ASD Information Security Manual: ISM-1649, Implement just-in-time administration for system access, which asks for the same thing.
ISO/IEC 27001: 3 mappings
This control partially meets A.5.15.
Annex A 5.15 requires rules and procedures to control access to information and systems based on business and security requirements. E8-RA-ML3.3 specifically mandates just-in-time administration for systems and applications, providing a concrete privileged access procedure consistent with controlled access principles. The Essential Eight requirement is a narrower, maturity-specific control, while Annex A 5.15 covers broader access control governance across physical and logical access.
This control partially meets A.5.18.
E8-RA-ML3.3 requires implementing just-in-time administration so privileged access is only granted when required and expires after a limited period. ISO/IEC 27001:2022 Annex A 5.18 covers provisioning, reviewing, modifying and removing access rights throughout the access lifecycle. JIT administration is a targeted technique within that lifecycle (temporary provisioning/removal), while Annex A 5.18 is broader and includes periodic reviews and general access-rights governance beyond administration scenarios.
This control partially meets A.8.2.
E8-RA-ML3.3 requires JIT administration, a specific method for controlling the allocation and use of privileged access by making it time-bound and on-demand. ISO/IEC 27001:2022 Annex A 8.2 requires privileged access rights to be restricted and managed across their lifecycle, which can be achieved through multiple methods including JIT. E8-RA-ML3.3 is therefore a specific implementation approach within the broader expectations of Annex A 8.2.
ASD Information Security Manual: 5 mappings
This control is equivalent to ISM-1649.
E8-RA-ML3.3 requires just-in-time (JIT) administration to be used when administering systems and applications, limiting high-level access to when it is needed. ISM-1649 explicitly mandates JIT administration for administering systems and their resources, matching the same core requirement. The only practical difference is wording (systems and resources vs systems and applications), but the intent and control outcome are substantially the same.
This control partially overlaps ISM-0445.
ISM-0445 requires privileged users to be issued a dedicated privileged account used only for privileged duties. E8-RA-ML3.3 requires just-in-time administration, which can change how privileged accounts are provisioned/activated and often works in tandem with separate admin accounts. ISM-0445 mandates separation of accounts, while E8-RA-ML3.3 focuses on time-bounded elevation and does not necessarily require separate named accounts.
This control partially overlaps ISM-1508.
E8-RA-ML3.3 requires JIT administration so privileged access is only granted when required and for limited durations. ISM-1508 overlaps by requiring privileged access to be limited to what is required for duties, and JIT is a common mechanism to enforce that access is not continuously available. ISM-1508 focuses on least privilege (what access is granted), while E8-RA-ML3.3 focuses on time limitation (when and how long access exists).
This control supports ISM-1927.
ISM-1927 requires limiting access to key Microsoft identity servers (AD DS/CS/FS and Entra Connect) to privileged users who need it. E8-RA-ML3.3 supports this outcome by using just-in-time administration to minimise standing privileged access, reducing the window in which users can access or administer those servers. E8-RA-ML3.3 is not server-specific, but it materially strengthens the access limitation required by ISM-1927.
This control supports ISM-1939.
ISM-1939 requires that organisations minimise the number of accounts in highly privileged groups (e.g. Domain Admins/Enterprise Admins). E8-RA-ML3.3 supports this by implementing just-in-time administration so users do not require standing membership in highly privileged groups to perform administrative tasks. E8-RA-ML3.3 focuses on time-bounded elevation rather than explicitly measuring or minimising group membership counts.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-05.2Require explicit session establishment and time-bound grants for privileged actionsPartially overlaps
This control partially overlaps IT.PRO-05.2.
IT.PRO-05.2 requires explicit session establishment controls before privileged actions are permitted, including time-bound privilege grants; E8-RA-ML3.3 requires just-in-time administration of systems and applications, which closely matches those time-bound grants.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.