ASD ISM 1263 Enforce unique accounts for server administration
What it says
Unique privileged user accounts are used for administering individual server applications.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishAdministrators must use unique accounts to manage each server application.
Each administrator needs to have their own account when managing software on servers. This is important because if everyone shares the same account, you can't track who made changes. Mistakes or malicious actions can then go undetected, putting the entire server at risk by making it hard to figure out who did what.
Free. Save your status, tasks and notes.
Why it matters
Without unique admin accounts, tracing changes is difficult, increasing the risk of undetected malicious actions and operational disruptions.
How to implement
The IT team should create individual accounts for each system administrator on every server.
This can be done by accessing the server management console and setting up separate login credentials for each person responsible for administration tasks.
System owners should regularly review the list of accounts with access to their servers.
Schedule monthly checks to ensure every account listed belongs to a current staff member and remove any accounts for people who have left the organisation.
Managers should educate admins on secure account management.
Organise a training session on why it's important to avoid sharing accounts, how to create strong passwords, and the importance of changing passwords regularly.
The IT department should set up a process for onboarding and offboarding administrators.
This involves establishing a checklist that guides creating or removing accounts when administrators join or leave the organisation.
Protection measures like password policies should be implemented by the IT team.
Use settings that enforce strong passwords and regular password changes, thus reducing the risk of unauthorised access due to weak or old passwords.
Keep it running
Regularly audit privileged accounts to confirm each administrator uses a unique account per server application, and alert on any shared credentials or concurrent logons.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A list of all current system administrators.
Look at
Whether each admin has a unique identifier instead of a shared account.
Good evidence
Outcome is seeing that every administrator has a distinct account name aligning with their actual name.
- Check 2 of 5What an auditor asks for
Good evidence
Outcome shows recent account audits with minimal inactive accounts.
- Check 3 of 5What an auditor asks for
Ask for
Logs that show account activity on server applications. Check to see if the logs can specify which admin made changes.
Good evidence
Result displays logs that clearly tie actions to specific, named accounts.
- Check 4 of 5What an auditor asks for
Look at
The attendance records to ensure all admins have completed this training.
Good evidence
Includes up-to-date records showing that all current admins received training.
- Check 5 of 5What an auditor asks for
Ask for
To see the password policy applied to admin accounts. Examine if it includes requirements for password complexity and periodic changes.
Good evidence
Result shows an active policy ensuring strong, regularly updated passwords.
Mappings
Closest match in ASD Essential Eight: E8-RA-ML1.2, Dedicated privileged user accounts for privileged duties, which this control covers in full and more.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.2.
ISM-1263 requires unique privileged user accounts to be used for administering individual server applications. Annex A 8.2 relates because it requires privileged access rights to be restricted and managed, which commonly includes avoiding shared administrator accounts and ensuring accountability. ISM-1263 is a specific implementation pattern within the broader privileged access governance required by Annex A 8.2.
ASD Essential Eight: 2 mappings
This control is broader than E8-RA-ML1.2.
E8-RA-ML1.2 requires a dedicated privileged account be used only for duties requiring privileged access. ISM-1263 narrows this by requiring unique privileged user accounts for administering individual server applications. ISM-1263 goes deeper into per-application administrative separation, which is a specific way to implement E8-RA-ML1.2.
This control depends on E8-RA-ML3.1.
E8-RA-ML3.1 requires privileged access to be limited to only what is necessary for duties. ISM-1263 strengthens this by requiring unique privileged accounts for administering individual server applications, enabling tighter scoping and reducing privilege re-use across systems. ISM-1263 focuses on account separation and traceability rather than directly defining what privileges are necessary.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.