ASD ISM 1898 Use secure admin workstations for administration
What it says
Secure Admin Workstations are used in the performance of administrative activities.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUse special secure computers for admin tasks to protect sensitive data.
Using secure admin workstations means setting up special, highly-protected computers for sensitive tasks like managing your business's IT systems. This is crucial because if regular computers are used for these tasks, a security breach could give hackers the keys to your digital kingdom, risking data theft or business disruption.
Free. Save your status, tasks and notes.
Why it matters
Without secure admin workstations, attackers can steal admin credentials and use privileged access to breach systems and compromise the network.
How to implement
IT team should identify which computers will be designated as secure admin workstations.
They can do this by selecting machines that are used exclusively for administrative duties and ensuring they don't have any unnecessary software that could introduce vulnerabilities.
System owners should work with IT to configure secure admin workstations.
This means setting them up with only essential software, applying strict security settings, and ensuring they are isolated from non-admin network areas.
Managers should create a policy that defines what tasks must be conducted on secure admin workstations.
This involves listing specific activities like server management and database access for clarity and compliance.
Managers and IT should ensure only authorised personnel can use secure admin workstations.
Assign a small group of trusted employees to have access and regularly review and update who these people are.
HR and IT should implement a training program for employees using secure admin workstations.
This includes teaching them about the importance of using these machines correctly and how to recognise potential security threats.
Keep it running
Use dedicated secure admin workstations only for privileged tasks; prevent email/web use, enforce allow-listing, and keep them patched and isolated from user endpoints.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The list of designated secure admin workstations.
Look at
Whether this list matches the physical inventory and is regularly reviewed.
Good evidence
An up-to-date list aligned with the latest inventory records.
- Check 2 of 5What an auditor asks for
Look at
Clarity on which tasks are to be performed exclusively on these machines.
Good evidence
A detailed policy with specific tasks and roles defined.
- Check 3 of 5What an auditor asks for
Ask for
Access logs of the secure admin workstations. Check for consistency with authorised user lists and unusual access patterns.
Good evidence
Logs showing only authorised users have accessed the workstations at expected times.
- Check 4 of 5What an auditor asks for
Look at
Evidence that shows completed training and knowledge assessments.
Good evidence
Comprehensive records indicating all users have up-to-date training.
- Check 5 of 5What an auditor asks for
Ask for
Security configurations documentation of the secure admin workstations.
Look at
Settings such as software installed and network permissions.
Good evidence
Configurations showing minimum necessary software and restricted network access.
Mappings
Closest match in ASD Essential Eight: E8-RA-ML3.2, Use secure admin workstations for administrative tasks, which asks for the same thing.
ISO/IEC 27001: 2 mappings
This control is broader than A.8.1.
ISM-1898 requires a specific endpoint type (Secure Admin Workstations) to be used for administrative activities to protect privileged actions and associated data. ISO/IEC 27001:2022 Annex A 8.1 requires protection of user endpoint devices more generally, covering all endpoints and the information they store/process/access. ISM-1898 is a specific, privileged-administration-focused implementation that fits within the broader endpoint protection requirement of Annex A 8.1.
This control partially meets A.8.2.
ISM-1898 requires Secure Admin Workstations for administrative activities to reduce the likelihood of privileged access being abused or stolen via standard endpoints. ISO/IEC 27001:2022 Annex A 8.2 requires privileged access rights to be restricted and managed, focusing on how privilege is granted and controlled. Secure Admin Workstations support Annex A 8.2 by reducing credential exposure and providing a controlled environment for using privileged rights, but they do not by themselves define privileged rights management processes.
ASD Essential Eight: 2 mappings
This control is equivalent to E8-RA-ML3.2.
ISM-1898 requires Secure Admin Workstations to be used when performing administrative activities to reduce exposure of privileged actions and credentials. E8-RA-ML3.2 states the same requirement: administrators perform admin tasks using Secure Admin Workstations. Both controls align in intent, scope, and implementation outcome, with only framework phrasing differences.
This control partially overlaps E8-RA-ML2.4.
E8-RA-ML2.4 requires administrative activities to be conducted through jump servers to control and monitor privileged management access. ISM-1898 requires the use of Secure Admin Workstations (SAWs) to perform administrative activities, which is a related method for securing privileged administration. They overlap in protecting privileged administration sessions, but E8-RA-ML2.4 focuses on the network access path (jump server), while ISM-1898 focuses on the endpoint used to administer systems.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.