ASD ISM 0611 Restrict privileges for gateway administrators
What it says
System administrators for gateways are assigned the minimum privileges required to perform their duties.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishGateway admins have only the necessary access permissions for their tasks.
This guideline is about making sure that people who manage gateway systems have just enough access to do their job and no more. If they have too much access, there's a higher chance of accidental or malicious damage, which could lead to data breaches or loss of service.
Free. Save your status, tasks and notes.
Why it matters
Excess gateway admin privileges can lead to unauthorised data access, increasing the risk of data breaches and service outages.
How to implement
The IT manager should create a list of all the tasks that gateway administrators do so they can decide what access is necessary.
This involves talking to the administrators about their daily duties and understanding each task's requirements.
HR and IT should work together to define roles and responsibilities clearly.
They should document what access each role needs, and ensure this is reflected in the IT systems by setting permissions accordingly.
System administrators should regularly review and audit the access levels of gateway administrators to ensure they have only what is necessary.
They can do this by running reports on who has access to what and assessing whether it aligns with their current job responsibilities.
The IT team should use a system that logs and monitors access attempts and activities on gateways.
They can set up alerts for unusual access patterns to detect any misuse of privilege.
Keep it running
Regularly review gateway admin accounts and role memberships to confirm only minimum required privileges are assigned, and promptly remove any unnecessary access.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A document that lists all gateway administrators and their access levels.
Look at
The specific permissions each administrator has been granted.
Good evidence
Shows each person has only the permissions required for their role, with unnecessary permissions removed.
- Check 2 of 5What an auditor asks for
Look at
Documented outcomes that indicate if any changes or revocations of access were necessary.
Good evidence
Includes evidence of regular reviews and prompt adjustments.
- Check 3 of 5What an auditor asks for
Ask for
Logs or records of access attempts to the gateways.
Look at
Whether there are any alerts or incidents related to unauthorised access.
Good evidence
Shows that the organisation monitors access continuously and responds to potential threats swiftly.
- Check 4 of 5What an auditor asks for
Good evidence
Is a complete training record with recent updates.
- Check 5 of 5What an auditor asks for
Ask for
Access change requests documentation.
Look at
How changes to access levels are requested and authorised.
Good evidence
A clear process with approvals documented in each instance, demonstrating control over access modifications.
Mappings
Closest match in ASD Essential Eight: E8-RA-ML3.1, Limit privileged access to what is necessary for duties, which asks for the same thing.
ISO/IEC 27001: 3 mappings
This control partially meets A.5.15.
ISM-0611 requires that gateway administrators are assigned only the minimum privileges required for their duties. ISO/IEC 27001:2022 Annex A 5.15 requires access control policies and procedures to be established and implemented based on business and security requirements. ISM-0611 is a concrete least-privilege rule that would normally be expressed and enforced through the policies and procedures required by Annex A 5.15.
This control partially meets A.8.2.
ISM-0611 requires that gateway system administrators are assigned the minimum privileges required to perform their duties. ISO/IEC 27001:2022 Annex A 8.2 requires privileged access rights to be restricted and managed, covering allocation, use, and ongoing control of these rights across the organisation. ISM-0611 is a specific least-privilege requirement for a particular admin cohort (gateways) within the broader privileged access management expectations of Annex A 8.2.
This control partially meets A.8.3.
ISM-0611 requires gateway administrators to have only the minimum privileges necessary for their duties. ISO/IEC 27001:2022 Annex A 8.3 requires access to information and associated assets to be restricted in accordance with the organisation's access control policy. ISM-0611 is a specific application of access restriction (least privilege) to a defined privileged role, while Annex A 8.3 applies broadly to all access types and assets.
ASD Essential Eight: 1 mapping
This control is equivalent to E8-RA-ML3.1.
ISM-0611 requires gateway system administrators to be assigned the minimum privileges necessary to perform their duties. E8-RA-ML3.1 requires privileged access across systems, applications, and data repositories to be limited to what is necessary for duties, directly reflecting the same least-privilege outcome. The main difference is scope framing: ISM-0611 is specific to gateway administrators, while E8-RA-ML3.1 pertains to all privileged users and services.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.