ASD ISM 1833 Limit privileges for user accounts in Active Directory
What it says
User accounts are provisioned with the minimum privileges required.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUser accounts are set up with just the access they need, nothing extra.
This control is about making sure user accounts in your organisation have just enough permission to do their jobs, nothing more. This matters because if accounts have too much access, a mistake or malicious action could harm sensitive information or cause other serious issues.
Free. Save your status, tasks and notes.
Why it matters
If AD user accounts have excessive group memberships or delegated rights, misuse or compromise can enable unauthorised access to sensitive data and systems.
How to implement
IT team should conduct a privilege audit: Periodically review who has access to what within your systems.
Use a checklist of roles and tasks to ensure no account has unnecessary permissions.
Managers should define access levels: Work with the IT team to list specific job roles and the minimum access each needs to perform tasks effectively.
Ensure this list is kept updated and reflects any role changes.
HR and IT should collaborate on onboarding: When new staff join, HR should coordinate with IT to assign only necessary access rights based on documented role requirements.
Ensure the process is formalised with approval steps.
IT should implement an access review schedule: Regularly, perhaps quarterly, have the IT team check current user access against outlined role requirements.
Adjust privileges for anyone who no longer needs certain levels of access.
System owner should maintain documentation: Keep a secure and up-to-date record of each account's access level and any changes made over time.
This helps resolve any access disputes and supports auditing processes.
Keep it running
Periodically review AD user group memberships and delegated permissions against role needs; promptly remove elevated or stale access when duties change or staff leave.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The user account access log: Request a report detailing current access levels assigned to each user.
Look at
Clear alignment between roles and their access levels.
Good evidence
Each user has a documented access level matching their role.
- Check 2 of 5What an auditor asks for
Ask for
Records of recent access changes: Request logs or documentation showing who changed access rights and when.
Look at
Whether there is a documented request or approval for each change.
Good evidence
Each change has a corresponding authorisation record.
- Check 3 of 5What an auditor asks for
Ask for
The role access definition document: See if there's a current document outlining access levels for each role.
Look at
How detailed and specific the role definitions are.
Good evidence
A comprehensive list with clear mapping of roles to access requirements.
- Check 4 of 5What an auditor asks for
Ask for
The schedule of access reviews: Request records showing when and how often access reviews were conducted.
Look at
Adherence to the planned schedule in the records.
Good evidence
Consistent reviews with adjustments made promptly when needed.
- Check 5 of 5What an auditor asks for
Ask for
Documentation of the onboarding process: Request to see how the access set-up process is documented for new users.
Look at
Evidence of a formal procedure including role assessment and approval steps.
Good evidence
An onboarding checklist with documented role-based access rights and approval signatures.
Mappings
Closest match in ASD Essential Eight: E8-RA-ML1.4, Limit privileged user accounts to essential online service access, which this control covers in full and more.
ISO/IEC 27001: 2 mappings
This control partially overlaps A.5.18.
Annex A 5.18 requires access rights to be provisioned and maintained according to business rules and access control policy, which typically includes least-privilege principles. ISM-1833 relates by explicitly requiring user accounts to be provisioned with the minimum privileges required, influencing provisioning and subsequent modification decisions. ISM-1833 focuses on least privilege for account provisioning, while Annex A 5.18 covers the entire access-rights lifecycle including periodic reviews and removal.
This control partially overlaps A.8.3.
ISM-1833 requires Active Directory user accounts to be provisioned with the minimum privileges required. Annex A 8.3 broadly requires restricting access to information and associated assets in accordance with the access control policy, which includes least-privilege restrictions across the organisation. ISM-1833 is a narrower, technology-specific application of this principle focused on AD account privilege assignment rather than all information assets and access paths.
ASD Essential Eight: 2 mappings
This control is broader than E8-RA-ML1.4.
E8-RA-ML1.4 requires that privileged accounts authorised for online services have only the access required to perform their duties. ISM-1833 supports this outcome by requiring user accounts (in AD provisioning) to be given minimum privileges, which is a practical mechanism used to enforce least privilege for privileged identities. ISM-1833 is broader in covering account provisioning generally, while the primary is specifically about privileged accounts and online service access.
This control partially meets E8-RA-ML3.1.
ISM-1833 requires Active Directory user accounts to be provisioned with the minimum privileges required. E8-RA-ML3.1 requires that privileged access across systems, applications and data repositories is limited to what is necessary for duties, which is the same least-privilege outcome but across a wider technology scope than AD. ISM-1833 is a specific implementation focus (AD user account privileges) within the broader privileged-access restriction intent of E8-RA-ML3.1.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.