ASD ISM 0405 Validation for unprivileged system access requests
What it says
Requests for unprivileged access to systems and their resources are validated when first requested.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishRequests for basic system access are checked when they are first made.
When someone wants to access a computer system for everyday tasks, their request is checked at the very beginning. This is important because if you don't verify requests first, unauthorised people could gain access, leading to stolen data or other security issues.
Free. Save your status, tasks and notes.
Why it matters
Failure to validate unprivileged access requests can lead to unauthorised access, data breaches, and misuse of system resources by unapproved users.
How to implement
The system owner should create a checklist of who can approve new access requests and the criteria they need to meet.
This involves working with the HR department to ensure the list includes all necessary details about the employee and their role.
The IT team should design an access request form that collects relevant information about the person needing access and the level of access required.
This can be done by using simple online forms that automatically record details.
Line managers should review each access request for their team members to ensure it aligns with their job role.
This should be done by comparing the employee's job description with the access requested, ensuring no unnecessary privileges are granted.
The HR department should maintain an updated list of staff roles and corresponding access levels.
This ensures that the IT team has accurate information to validate any access requests.
Staff responsible for approving access should be trained on how to evaluate requests properly.
This includes knowing the potential risks of granting access and ensuring requests align with organisational policies.
Keep it running
Validate each unprivileged access request at submission against user identity and business need, and record approvals/denials to provide an auditable trail.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Recent access request logs: Examine the log to see that each request is accompanied by a completed form and approval signature.
Good evidence
Shows completed requests with clear approvals and reasons for granting access.
- Check 2 of 5What an auditor asks for
Good evidence
Is all approvals matching the criteria outlined without exception.
- Check 3 of 5What an auditor asks for
Ask for
Them to explain how they verify that the access level requested is appropriate for the role.
Good evidence
Shows managers are aware of and adhere to access guidelines.
- Check 4 of 5What an auditor asks for
Good evidence
Is a smooth process where each step is clearly followed and documented.
- Check 5 of 5What an auditor asks for
Ask for
Training records of staff responsible for approving access: Review records to confirm that employees received training on the access approval process.
Good evidence
Includes completion certificates or sign-in sheets showing who attended and when.
Mappings
Closest match in ISO/IEC 27001: A.5.15, Access control policies and procedures, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.15.
Annex A 5.15 requires organisations to establish and implement access control policies and procedures based on business and security requirements. ISM-0405 requires validation of requests for unprivileged access when first requested, which is an access provisioning control supporting least privilege. ISM-0405 is a specific procedural step within the wider access management rules and processes expected by Annex A 5.15.
This control partially meets A.5.18.
ISM-0405 requires that requests for unprivileged access to systems and resources are validated when first requested. This aligns with Annex A 5.18 because initial validation is a key part of provisioning access rights in a controlled way. However, Annex A 5.18 is broader as it also requires ongoing review, modification and removal of access rights beyond the initial request stage.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.