ASD ISM 1507 Ensure requests for privileged access are verified
What it says
Requests for privileged access to systems and their resources are validated when first requested.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishRequests for special system access are checked before approval to prevent unauthorised use.
This control ensures that when someone requests special access to important parts of a computer system, their request is checked to make sure they should have that access. This matters because if people get access they shouldn't, they could misuse or damage the system, leading to data leaks, financial loss, or harm to the business's reputation.
Free. Save your status, tasks and notes.
Why it matters
Unverified privileged access requests can enable unauthorised access, data exposure or system compromise, leading to financial loss and reputational damage.
How to implement
The IT manager should set up a process where all requests for special access are submitted using a standardised form.
This ensures that no request is missed and each one is recorded for review before access is granted.
HR should work with department heads to identify which roles need special system access and document these roles clearly.
This helps the IT team know which requests are legitimate based on job needs.
System administrators should verify each access request against this documented list of roles needing special access.
They can do this by checking the request against the role requirements before granting access.
A nominated security officer should conduct a review of recent access requests monthly.
They should check that each request had the necessary approval and matches documented roles.
The IT team should implement a system that automatically alerts them when a request for special access is made.
This technology can help flag requests that need urgent attention or verification.
Keep it running
Verify each privileged access request at first request (identity, business need, approvals), record evidence, and review logged approvals regularly to detect misuse.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The log of all privileged access requests: Check the log to see if each request is recorded with the requestor's details and purpose.
Good evidence
Includes a comprehensive log with names, date of request, and reason for access.
- Check 2 of 5What an auditor asks for
Ask for
Documentation of roles and their access needs: Ensure this document shows what access levels are required for different job roles. Good documentation will list all roles and their corresponding access requirements and approvals.
- Check 3 of 5What an auditor asks for
Ask for
Recent approved access requests: Compare these to the role requirements document. Good compliance is when every request aligns with an authorised role requirement.
- Check 4 of 5What an auditor asks for
Ask for
To see the process documentation for checking requests: Verify that the steps include checking each request against a pre-approved list and obtaining the necessary managerial authorisations.
Good evidence
Shows a clear, consistent, and easily accessible process.
- Check 5 of 5What an auditor asks for
Ask for
Monthly review reports done by the security officer: Look to see if these reports detail inaccuracies or improper requests, and any steps taken to rectify issues. Good reports will list identified issues and documented actions taken.
Mappings
Closest match in ASD Essential Eight: E8-RA-ML1.1, Validating privileged access requests upon initial request, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.2.
ISM-1507 requires organisations to verify (validate) privileged access requests when they are first raised, focusing on the authorisation decision point. Annex A 8.2 requires privileged access rights to be restricted and managed across their allocation and use. ISM-1507 is one specific control activity within the broader ISO requirement to manage privileged access rights end-to-end.
ASD Essential Eight: 4 mappings
This control is equivalent to E8-RA-ML1.1.
ISM-1507 requires that requests for privileged access to systems and resources are validated at the time they are first requested. E8-RA-ML1.1 states the same requirement for systems, applications and data repositories, focusing on initial validation of privileged access requests before approval. The scope and intent align closely, with only minor wording differences in the assets referenced.
This control partially overlaps E8-RA-ML2.1.
ISM-1507 requires privileged access requests to be validated when first requested, ensuring initial approval is legitimate and authorised. E8-RA-ML2.1 requires privileged access to be disabled after 12 months unless revalidated, which is a periodic re-approval mechanism. They overlap in the concept of validating entitlement, but ISM-1507 is upfront verification while E8-RA-ML2.1 is lifecycle revalidation and expiry control.
This control partially overlaps E8-RA-ML3.1.
ISM-1507 requires validation of privileged access requests at the time of initial request to prevent unauthorised elevation. E8-RA-ML3.1 requires limiting privileged access to what is necessary for duties, which typically relies on verifying the legitimacy and business need of a request. However, E8-RA-ML3.1 focuses on least privilege outcomes (scope of access), while ISM-1507 focuses on the request verification process.
This control supports E8-RA-ML1.4.
E8-RA-ML1.4 requires that privileged accounts authorised for online service access are strictly limited to what is necessary. ISM-1507 supports this by requiring validation of requests for privileged access at the time of request, helping ensure online service authorisations and associated privileges are justified and duty-aligned. ISM-1507 addresses request validation, whereas the primary addresses the actual restriction of granted online service access.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.