ASD ISM 1619 Configure service accounts as managed service accounts
What it says
Service accounts are created as group Managed Service Accounts.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure service accounts are created as Managed Service Accounts for improved security.
Using Managed Service Accounts (MSAs) for service accounts means that these accounts are better protected and managed automatically. If this isn't done, your organisation might leave backdoor access open to critical systems, potentially leading to data breaches or service disruptions.
Free. Save your status, tasks and notes.
Why it matters
Without group Managed Service Accounts, service credentials are harder to protect, increasing risk of account takeover, unauthorised access and data breaches.
How to implement
IT team should review existing service accounts to identify which ones can be converted into Managed Service Accounts.
Start with accounts that have high access privileges and schedule a plan to transition them to MSAs using available tools or by consulting software manuals.
System administrators should configure new service accounts as Managed Service Accounts by default.
This can be done by using Windows Active Directory features that support creating MSAs, which help automate password management and provide inherent security benefits.
IT managers should educate their teams on the benefits of using MSAs.
Conduct a workshop to explain how MSAs reduce administrative overhead and improve security, using clear examples and scenarios relevant to your organisation.
Security officers should ensure compliance with ACSC (Australian Cyber Security Centre) guidelines on service account management.
Cross-reference your setup with the Essential Eight framework, focussing on the benefits of automating password changes through MSAs.
Keep it running
Use group Managed Service Accounts for services, remove unused gMSAs, and regularly review which hosts and services are permitted to use each gMSA.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A list of all service accounts in use: Request documentation detailing which service accounts exist and their purpose.
Look at
Whether MSAs are used for each account and verify recent creation or modification dates.
Good evidence
Shows a clear list with MSAs implemented wherever applicable.
- Check 2 of 5What an auditor asks for
Ask for
To see system logs showing MSA activity: Request logs that document service account behaviour over time.
Look at
Whether MSAs are interacting with systems according to expected patterns without failed access attempts.
Good evidence
Will feature regular, automated password updates without anomalies.
- Check 3 of 5What an auditor asks for
Ask for
Documentation on MSA policy: Obtain written policies on how service accounts are managed within the organisation.
Look at
Statements specifically endorsing the use of MSAs and guidelines for their setup.
Good evidence
Policy will include clear roles, responsibilities, and procedures for configuring MSAs.
- Check 4 of 5What an auditor asks for
Ask for
Training logs or records: Request records showing when staff received training on MSAs.
Look at
Dates and content of the training sessions to ensure personnel are knowledgeable about MSAs.
Good evidence
Record includes up-to-date training sessions attended by relevant staff members.
- Check 5 of 5What an auditor asks for
Ask for
Evidence of compliance checks: Request reports or minutes from meetings where security compliance, including MSA usage, was reviewed.
Look at
Evidence that these checks are regular and thorough.
Good evidence
Will show documented checklists or action items ensuring MSAs are standard practice.
Mappings
Closest match in ISO/IEC 27001: A.5.16, Identity life cycle management, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.5.16.
ISM-1619 requires service accounts to be created specifically as group Managed Service Accounts (gMSAs) to improve security of service identity use. Annex A 5.16 requires the organisation to manage the full identity life cycle (creation, management, changes, and retirement) for identities, which includes service account identities. ISM-1619 is a specific technical implementation choice within the broader identity life cycle management outcomes required by Annex A 5.16.
ASD Essential Eight: 1 mapping
This control partially meets E8-RA-ML2.5.
ISM-1619 requires service accounts to be created as gMSAs so their credentials are system-managed rather than manually set and reused. E8-RA-ML2.5 requires service account (and other admin) credentials to be long, unique, unpredictable and managed, which gMSAs directly help achieve through automatic password management and rotation. ISM-1619 does not by itself define all credential policy requirements (e.g. break glass handling), but it materially strengthens meeting E8-RA-ML2.5 for service accounts.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-12.3Provision user, administrative and non-person accounts with minimum required privilegesPartially overlaps
This control partially overlaps IT.PRO-12.3.
IT.PRO-12.3 requires user, administrative and non-person accounts to be provisioned with only the minimum access and privileges they need; ISM-1619 requires service accounts to be created as group Managed Service Accounts, a related rule for those non-person accounts that does not itself limit their privileges.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.