ASD ISM 1648 Disabling inactive privileged access to systems
What it says
Privileged access to systems and their resources are disabled after 45 days of inactivity.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishAccess with special privileges is disabled if not used for 45 days to enhance system security.
This control is about turning off special access rights to systems if they haven't been used in 45 days. It matters because people with special privileges can make big changes or access sensitive information. If their access isn't switched off when they're not using it, it could be a way for hackers to cause damage if those accounts get hacked.
Free. Save your status, tasks and notes.
Why it matters
If inactive privileged access is not disabled after 45 days, dormant admin accounts can be hijacked to gain elevated access and compromise systems.
How to implement
The IT team should review all accounts with special privileges every month.
Make a list of any accounts that haven't been used in the last 45 days. This helps identify accounts that need to have their access turned off.
System administrators should set up notifications to alert them when a privileged account reaches 30 days of inactivity.
Use system tools or scripts to keep track of when each account was last used, so actions can be taken before reaching 45 days.
Managers should work with the IT team to ensure there is a clear process for reactivating access.
This includes a simple request form or process that employees can use if they need their privileges back after being disabled.
The HR team should ensure that all employees understand the importance of using their privileged access regularly if needed, or reporting back when no longer required.
Include this in onboarding and regular training sessions.
Security officers should create and maintain a policy document stating how inactive privileged access will be handled.
This should detail who is responsible for checking inactivity and the steps to disable access, helping everyone understand the procedure.
Keep it running
Run a weekly report of privileged account activity and automatically disable privileged access after 45 days of inactivity; alert owners at 30/40 days.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A report detailing privileged accounts and their last active dates.
Look at
The dates to confirm accounts inactive for over 45 days are disabled.
Good evidence
Is a record showing accounts with clear last-used dates and confirmation of deactivated status.
- Check 2 of 5What an auditor asks for
Good evidence
Will include routine alert creation and actions taken for inactive accounts.
- Check 3 of 5What an auditor asks for
Ask for
A reactivation request process document.
Look at
The clarity and simplicity of the process, ensuring all steps are logical and easy for employees to follow.
Good evidence
Is a clear, concise document with step-by-step instructions.
- Check 4 of 5What an auditor asks for
Good evidence
Includes comprehensive coverage of the topic in onboarding and training.
- Check 5 of 5What an auditor asks for
Ask for
The policy document related to disabling inactive privileged access.
Look at
Whether the document clearly outlines responsibilities and steps.
Good evidence
Is an organised document with detailed procedures and who is responsible at every stage.
Mappings
Closest match in ASD Essential Eight: E8-RA-ML2.2, Privileged access is disabled after 45 days of inactivity, which asks for the same thing.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.18.
ISM-1648 requires disabling privileged access after 45 days of inactivity as part of keeping access current and reducing unnecessary elevated access. Annex A 5.18 addresses the broader lifecycle of access rights, including provisioning, reviewing, modifying and removing access in line with an access control policy. ISM-1648 is a specific removal/disablement rule that would typically be implemented as one mechanism under Annex A 5.18's wider access-rights management framework.
This control partially meets A.8.2.
ISM-1648 requires a specific administrative action: disabling privileged access after 45 days of inactivity. Annex A 8.2 requires privileged access rights to be restricted and managed more broadly across allocation and use. ISM-1648 is a concrete lifecycle/housekeeping mechanism that fits within the broader privileged access management expectations of Annex A 8.2.
ASD Essential Eight: 1 mapping
This control is equivalent to E8-RA-ML2.2.
ISM-1648 requires privileged access to systems and their resources to be disabled after 45 days of inactivity. E8-RA-ML2.2 specifies the same 45-day inactivity disabling requirement for privileged access to systems and applications. Both controls are aligned in trigger condition (inactivity) and timeframe (45 days), and implementing one would largely satisfy the other.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.