ASD ISM 1380Privileged Users Work in Separate Privileged and Unprivileged Operating Environments
Official control statement
Privileged human users use separate privileged and unprivileged operating environments.
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
People who hold privileged access do their administrative work in one operating environment and their everyday computing in a different one, so the two never share a session.
What this means in practice
This control is about the people in your organisation who hold privileged access, such as system administrators, and the operating environment they sit in when they use that access. It asks that each of those people has two distinct operating environments: one that is used only for privileged activities, and one that is used for unprivileged, everyday activities such as reading email, browsing the web and working on documents. The person moves between the two environments rather than doing both kinds of work from the same one. It matters because the everyday environment is the one most exposed to attack. It receives email attachments, opens web links and runs ordinary productivity software, and any one of those can be the way malicious code arrives. If the same environment is also where privileged access is exercised, a single phishing email or drive-by download hands the attacker whatever privileges that person holds. Keeping privileged work in its own environment means that compromising the everyday environment does not, by itself, give an attacker a foothold in the privileged one. The control applies to human users only; it is about how people work, not about service or machine accounts.
Framework
ASD Information Security Manual (ISM)
Control effect (Control Stack)
Preventative
Classifications
NC, OS, P, S, TS
ISM last updated
Sept 2026
Control Stack last updated
29 Sept 2026
E8 maturity levels
ML1, ML2, ML3
Guideline
Guidelines for system managementSection
System administrationTopic
Separate privileged operating environments
Why it matters
If privileged human users perform their administrative work from the same operating environment they use for email, web browsing and general productivity, a compromise of that environment through phishing, a malicious download or a browser exploit directly exposes their privileged access. The attacker inherits the administrator's ability to change configurations, create accounts, access sensitive data and move across systems, turning what should have been a contained user-level incident into a whole-of-environment compromise.
Operational notes
Day to day, this control shows up as a habit that privileged users must keep and that the organisation must make easy to keep. Each privileged user needs a clearly identified privileged operating environment and a clearly identified unprivileged one, and needs to know which activities belong in each. Privileged activities happen only in the privileged environment; email, web browsing, document work and other everyday tasks happen only in the unprivileged environment.
When someone is granted privileged access for the first time, provisioning the separate privileged environment should be part of the onboarding steps, not an afterthought. When someone loses privileged access, the privileged environment should be withdrawn at the same time. Periodic checks that privileged users still have both environments, and are actually using the privileged one for privileged work, keep the separation from quietly eroding as people look for shortcuts.
Implementation tips
- The security team compiles and maintains a register of all privileged human users, drawn from directory group memberships and privileged role assignments, so that every person who needs a separate privileged operating environment is known.
- The IT operations team provisions a dedicated privileged operating environment for each privileged human user, distinct from the environment that person uses for everyday work, and records which environment is which against the user's name in the register.
- The security team writes a short procedure for privileged users that states which activities are privileged and must be done only in the privileged environment, and which are unprivileged and must be done only in the unprivileged environment, and issues it to every privileged user when access is granted.
- The identity and access team adds provisioning of the separate privileged operating environment to the privileged-access onboarding workflow, and adds its removal to the offboarding and access-revocation workflow, so environments are created and withdrawn in step with privileged access.
- The security team briefs privileged users on why the separation exists and how to move between the two environments during their work, and repeats the briefing whenever the environments or the procedure change.
Audit / evidence tips
- AskAsk for the register of privileged human users together with the record of the privileged and unprivileged operating environments assigned to each of them.Look atCheck that every privileged user in the register has two distinct operating environments recorded, and that none is listed with only one environment for both kinds of work.GoodEvery privileged human user has a separately identified privileged operating environment and a separately identified unprivileged one, with no gaps.
- AskAsk for the procedure or guidance issued to privileged users describing which activities belong in the privileged environment and which belong in the unprivileged environment.Look atRead it for a clear split of activities between the two environments and for evidence it was issued to privileged users, such as acknowledgements or distribution records.GoodThe guidance plainly assigns privileged activities to the privileged environment and everyday activities to the unprivileged environment, and privileged users have received it.
- AskAsk to sit with two or three privileged users and watch how they carry out a privileged task and an everyday task.Look atObserve whether they switch to their privileged environment for the privileged task and return to the unprivileged environment for email, browsing or documents.GoodPrivileged work is done only in the privileged environment and everyday work only in the unprivileged one, and users can explain why they keep them apart.
- AskAsk for the onboarding and offboarding records of privileged users who joined or left the privileged group in the review period.Look atCheck that the separate privileged operating environment was provisioned when privileged access was granted and withdrawn when it was removed.GoodEnvironment provisioning and removal line up with the dates privileged access was granted and revoked for each user sampled.
- AskAsk for the most recent periodic check confirming that privileged users still hold and use separate environments.Look atLook for the date of the check, who performed it, which users were covered and any exceptions found and followed up.GoodA recent check covers all privileged users, and any user found doing privileged work from an unprivileged environment has been corrected.
Cross-framework mappings
How ISM-1380 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
E8
| Control | Notes | Details |
|---|---|---|
equalEquivalent(1)expand_less | ||
open_in_fullBroader than(1)expand_less | ||
sync_altPartially overlaps(1)expand_less | ||
handshakeSupports(3)expand_less | ||
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in System management
See all Guidelines for system management controls, or browse the full ASD ISM library.