ASD ISM 1620 Ensure privileged accounts are secured in AD
What it says
Privileged user accounts are members of the Protected Users security group.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishPrivileged user accounts must belong to a special security group for extra protection.
This control is about making sure people with special access to important parts of your computer system are grouped together for extra security. If you don't do this, these privileged accounts might be easier targets for hackers, which could allow them to access sensitive information and cause serious harm to your business.
Free. Save your status, tasks and notes.
Why it matters
If privileged AD accounts are not in Protected Users, credentials can be more easily stolen or reused, enabling elevated access and wider compromise.
How to implement
The IT manager should identify who in the organisation requires privileged access to systems.
These are usually the administrators who manage major computer systems and networks.
Once identified, the IT team should create a unique security group called 'Protected Users' in the Active Directory, a tool that helps keep track of who can access what on a network.
The IT staff should then add all privileged user accounts to this 'Protected Users' group.
This can be done easily through the Active Directory management console by selecting user accounts and assigning them to the group.
Regularly review these privileged accounts: The IT manager should set a calendar reminder to review the membership of this group every three months, ensuring only the right people have access.
Train all users with privileged accounts: The IT manager should organise training sessions to remind these users about strong password practices and the importance of not sharing their login details.
Keep it running
Regularly audit Protected Users membership in Active Directory and remove unauthorised accounts; ensure privileged users are added and exceptions are documented.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
The list of privileged accounts: Request the document or report that lists all the privileged accounts in the 'Protected Users' group.
Look at
The list of members in the Active Directory for the specific 'Protected Users' group: Ensure all privileged accounts are listed and that regular user accounts are not included.
Good evidence
The list should only include IT administrators and other essential personnel with clear justifications documented for their access.
- Check 2 of 2What an auditor asks for
Ask for
Recent review records: Request logs or emails that show when the last review of this group was conducted.
Look at
The review logs: Ensure that there is a consistent schedule for review, ideally every three months, and any changes to group membership are documented.
Good evidence
Review records should show regular checks, with any changes to the group noted and authorised by IT leadership.
Mappings
Closest match in ISO/IEC 27001: A.8.2, Management of privileged access rights, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.2.
ISM-1620 requires a specific mechanism for securing privileged accounts by placing them in the AD Protected Users security group. Annex A 8.2 requires organisations to restrict and manage the allocation and use of privileged access rights more broadly. ISM-1620 is one concrete implementation that supports privileged access restriction, but it does not on its own cover the full management expectations in Annex A 8.2 (e.g. approval, review, and governance of privileged rights).
ASD Essential Eight: 1 mapping
This control depends on E8-RA-ML1.2.
E8-RA-ML1.2 requires privileged users to perform admin work using dedicated privileged accounts rather than their standard accounts. ISM-1620 strengthens that outcome by requiring privileged accounts to be placed into the Active Directory Protected Users group, hardening how those accounts authenticate and are used. ISM-1620 is about securing the privileged account configuration, whereas E8-RA-ML1.2 is about account separation and appropriate usage.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.