ASD ISM 1647 Disable privileged access after 12 months
What it says
Privileged access to systems and their resources are disabled after 12 months unless revalidated.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishPrivileged system access is disabled if not revalidated within a year.
This control means that if someone has special access to important systems or resources, it needs to be checked and confirmed at least once a year. If it's not reviewed and confirmed, their access is turned off. This is crucial to ensure that only the right people can access sensitive information and systems, preventing potential misuse or accidental damage.
Free. Save your status, tasks and notes.
Why it matters
Failing to regularly revalidate privileged access risks unauthorised access, leading to data breaches or system misuse by former employees.
How to implement
HR and IT Managers should create a schedule: Establish a calendar to review who has privileged access every year.
Use reminders to prompt reviews a month in advance to make sure nothing slips through the cracks.
The IT team should maintain an access register: Keep an updated list of who has privileged access.
Make this list easily accessible to ensure reviews can be conducted efficiently.
System owners should conduct access reviews: Meet individually with team members who have privileged access to confirm they still need it.
Document these reviews and any changes to access rights.
Train staff about access responsibilities: The manager should ensure everyone with privileged access understands the importance of annual reviews and the risks if access is not properly managed.
Set up automatic alerts: The IT team should use software tools to automatically flag privileged access accounts due for review, ensuring that no access goes unchecked.
Keep it running
Run a 12‑monthly review of privileged accounts; disable any not revalidated, record approvals, and remove access promptly when staff change roles or leave.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The privileged access review schedule: Request the schedule that outlines when access reviews are due and completed.
Look at
The dates to ensure reviews happen within 12 months.
Good evidence
Schedule shows all reviews completed on time and includes planned review dates.
- Check 2 of 5What an auditor asks for
Ask for
The access register: Request the document listing all individuals with privileged access. Check for completeness and regular updates.
Good evidence
Register is up-to-date and accurately reflects current access levels.
- Check 3 of 5What an auditor asks for
Ask for
Meeting records: Request minutes or notes from access review meetings.
Look at
Documented attendance, decisions made, and dates.
Good evidence
Record includes detailed actions and confirmations of access need.
- Check 4 of 5What an auditor asks for
Ask for
To see training records: Request evidence of training sessions on access management.
Look at
Attendee lists and training materials. Good documents show all necessary staff are trained and understand their responsibilities.
- Check 5 of 5What an auditor asks for
Ask for
System alerts: Have the IT team demonstrate the alerts set up for overdue reviews.
Look at
Recent alerts and their resolution.
Good evidence
System will have a log showing timely interventions when reviews are overdue.
Mappings
Closest match in ASD Essential Eight: E8-RA-ML2.1, Disable privileged access after 12 months without revalidation, which asks for the same thing.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.18.
ISM-1647 requires privileged access to be disabled after 12 months unless revalidated, which is an access-rights review and removal mechanism. ISO/IEC 27001:2022 Annex A 5.18 requires access rights to be provisioned, reviewed, modified and removed in accordance with policy, covering the full access-rights lifecycle. ISM-1647 is a specific review/removal rule for privileged access within the broader lifecycle processes mandated by Annex A 5.18.
This control partially meets A.8.2.
Annex A 8.2 requires privileged access rights to be restricted and managed through their lifecycle. ISM-1647 relates by requiring privileged access to be disabled after 12 months unless revalidated, which is a specific periodic review and revocation mechanism for privileged rights. ISM-1647 is a prescriptive subset (time-based revalidation), whereas Annex A 8.2 also encompasses broader privileged access management practices such as approval, logging, just-enough access and event-based revocation.
ASD Essential Eight: 3 mappings
This control is equivalent to E8-RA-ML2.1.
E8-RA-ML2.1 requires privileged access to be disabled after 12 months unless it is revalidated. ISM-1647 states the same requirement for privileged access to systems and their resources being disabled after 12 months unless revalidated. The scope, trigger (12 months), and mandated action (disable unless revalidated) align closely.
This control partially overlaps E8-RA-ML1.1.
E8-RA-ML1.1 requires organisations to validate privileged access requests when first requested to ensure only legitimate admin access is granted. ISM-1647 relates by requiring privileged access to be disabled after 12 months unless it is revalidated, which is a form of periodic re-approval. ISM-1647 addresses ongoing entitlement recertification and expiry, while E8-RA-ML1.1 is focused on the upfront approval step.
This control partially overlaps E8-RA-ML2.2.
E8-RA-ML2.2 requires privileged access to be disabled after 45 days of inactivity. ISM-1647 also requires disabling privileged access, but uses a different trigger and timeframe (after 12 months unless revalidated) rather than inactivity-based disabling at 45 days. They overlap on the objective of removing unnecessary privileged access, but differ materially in cadence and the mechanism (inactivity vs revalidation window).
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.