ASD ISM 1649 Implement just-in-time administration for system access
What it says
Just-in-time administration is used for the administration of systems and their resources.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUse just-in-time methods to manage who can access system resources, ensuring enhanced security.
This control is about giving people temporary access to computer systems only when they need it. This matters because if someone always has full access, it makes it easier for mistakes or attacks to happen, putting sensitive information at risk.
Free. Save your status, tasks and notes.
Why it matters
Without just-in-time admin access, persistent privileges expand the attack window, enabling credential misuse, privilege escalation and broader system compromise.
How to implement
The IT manager should set up a system where special access is given only when it's needed.
They can do this by using tools that allow temporary permission, ensuring staff can't get in unless it's required for a task.
Business owners should work with their IT team to identify which tasks need special system access.
Discuss specific job roles and tasks, deciding which require just-in-time access and ensure everyone understands the process.
HR should coordinate training sessions for staff on why just-in-time access is important.
Use easy-to-understand examples about risks of always-on access and how to request temporary access when needed.
Procurement managers should ensure any new software supports just-in-time access features.
This can be done by adding it as a requirement in software purchases and checking features during vendor demonstrations.
System administrators should audit current access permissions and remove permanent rights that aren't necessary.
This involves reviewing who has access to sensitive systems and switching to a just-in-time model with the right tools.
Keep it running
Use time-bound admin elevation only when needed; log and review approvals, monitor activity, and automatically revoke elevated access immediately after task completion.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Access logs for critical systems: Request logs showing when staff were granted special access. Look to see if access is temporary and linked to specific tasks.
Good evidence
Will show time-limited access tied to documented business needs.
- Check 2 of 5What an auditor asks for
Ask for
A list of who has privileged system access: Request a list from the IT team of employees with special access rights.
Look at
The reasons given for access.
Good evidence
Will show only necessary individuals have time-limited access based on current tasks.
- Check 3 of 5What an auditor asks for
Ask for
Training records on just-in-time access: Request documents or records showing staff attended relevant training.
Look at
Signed attendance sheets or records of online completion.
Good evidence
Will show recent completion of training by all relevant staff.
- Check 4 of 5What an auditor asks for
Ask for
Documentation of software procurement: Request reports from the procurement team showing software purchases with just-in-time access features. Look to see if this was a requirement in request documents.
Good evidence
Will include vendor commitments to these features.
- Check 5 of 5What an auditor asks for
Ask for
To see records of access reviews: Request documentation of regular access reviews by system administrators.
Look at
The frequency and outcome of these reviews.
Good evidence
Will show regular, documented checks and necessary adjustments.
Mappings
Closest match in ASD Essential Eight: E8-RA-ML3.3, Just-in-time administration is used for administering systems and applications., which asks for the same thing.
ISO/IEC 27001: 4 mappings
This control partially meets A.5.15.
ISM-1649 requires organisations to use just-in-time administration to control when administrative access is granted for system administration. Annex A 5.15 requires organisations to establish and implement access control policies and procedures governing logical (and physical) access based on business and security requirements. ISM-1649 is a specific privileged-access pattern that can sit under the broader ISO requirement for access control governance.
This control partially meets A.5.18.
ISM-1649 requires just-in-time administration to control the granting and use of administrative access for systems and resources. Annex A 5.18 requires access rights to be provisioned, reviewed, modified and removed in accordance with access control policy, covering the full access rights lifecycle. ISM-1649 is a specific technique that fits within Annex A 5.18's broader lifecycle management expectations, particularly for privileged rights activation and revocation.
This control partially meets A.8.2.
ISM-1649 requires the use of just-in-time administration for system administration, reducing persistent privileged access. Annex A 8.2 requires privileged access rights to be restricted and managed across their allocation and use. JIT administration is one concrete mechanism for managing privileged access, making ISM-1649 a specific subset of the broader privileged access management requirement in Annex A 8.2.
This control partially meets A.8.3.
ISM-1649 requires just-in-time administration to restrict administrative access temporally for systems and resources. Annex A 8.3 requires access to information and other associated assets to be restricted in accordance with the organisation's access control policy. JIT administration is one specific method of restricting access (especially privileged access), so ISM-1649 is a more specific subset of the broader access restriction requirement in Annex A 8.3.
ASD Essential Eight: 2 mappings
- E8-RA-ML3.3Just-in-time administration is used for administering systems and applications.Equivalent
This control is equivalent to E8-RA-ML3.3.
E8-RA-ML3.3 requires just-in-time (JIT) administration to be used when administering systems and applications, limiting high-level access to when it is needed. ISM-1649 explicitly mandates JIT administration for administering systems and their resources, matching the same core requirement. The only practical difference is wording (systems and resources vs systems and applications), but the intent and control outcome are substantially the same.
This control depends on E8-RA-ML2.1.
E8-RA-ML2.1 requires privileged access to be disabled after 12 months unless revalidated. ISM-1649 requires just-in-time administration for system administration, which supports reducing standing privileged access and therefore reduces the number of accounts requiring annual revalidation. ISM-1649 does not enforce a 12-month disablement rule, but it complements E8-RA-ML2.1 by limiting persistent privileged entitlements.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.