ASD ISM 1939 Minimise members in privileged security groups
What it says
The number of user accounts that are members of the Domain Admins, Enterprise Admins or other highly privileged security groups is minimised.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishLimit the number of users in highly privileged security groups like Domain Admins to enhance security.
This control is about keeping the list of people who have the most powerful access to your organisation's digital systems as small as possible. It matters because if too many people have high-level access, the risk of accidental or malicious damage to your data or systems increases.
Free. Save your status, tasks and notes.
Why it matters
Having too many members in privileged groups can increase the risk of data breaches or system failures due to misuse or errors.
How to implement
System owners should review the list of users with high-level access.
This involves regularly checking who is in groups like Domain Admins and removing any who don't absolutely need this level of access.
IT managers should work with HR to ensure that departing employees are promptly removed from privileged groups.
They should set up a process where HR notifies IT immediately when someone leaves the organisation.
Managers should periodically meet with IT to assess the necessity of privileged access for each role.
Hold these meetings quarterly and discuss any changes in job responsibilities that might affect access needs.
IT teams should implement a request-and-approval process for granting privileged access.
Require written justification for any new additions to privileged groups and approval from a senior manager.
Audit teams should establish a monitoring system to log and review all activity done by privileged accounts.
Use tools that provide alerts for unusual activity to catch potential misuse quickly.
Keep it running
Regularly review and minimise membership in privileged security groups to limit exposure. Ensure any access changes are well-documented and authorised.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
the current list of members in Domain Admins and similar groups.
Look at
the job roles of each member listed.
Good evidence
shows only essential personnel, aligned with their roles.
- Check 2 of 5What an auditor asks for
Look at
the timestamps and who authorised changes.
Good evidence
will show timely updates and appropriate approvals.
- Check 3 of 5What an auditor asks for
Ask for
records of quarterly access reviews by IT and managers.
Look at
meeting notes or review checklists.
Good evidence
provides documentation showing thoughtful review with actions taken.
- Check 4 of 5What an auditor asks for
Look at
detailed steps and HR-IT collaboration.
Good evidence
describes a clear, prompt process with roles and responsibilities.
- Check 5 of 5What an auditor asks for
Ask for
logs on activities performed by privileged accounts.
Look at
logged events for anything unusual.
Good evidence
shows regular log reviews with no unexplained, unusual access.
Mappings
Closest match in ISO/IEC 27001: A.8.2, Management of privileged access rights, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.2.
Annex A 8.2 requires privileged access rights to be restricted and managed, including limiting who holds highly privileged permissions. ISM-1939 relates by requiring minimisation of membership in Domain Admins, Enterprise Admins and other highly privileged groups. ISM-1939 is narrower and specific to certain AD groups, while Annex A 8.2 applies to privileged rights across all systems, applications and privilege models.
ASD Essential Eight: 3 mappings
This control partially meets E8-RA-ML3.1.
ISM-1939 requires minimising membership of highly privileged groups such as Domain Admins and Enterprise Admins. E8-RA-ML3.1 requires privileged access across systems, applications and data repositories to be limited to what is necessary for duties, which encompasses least privilege more broadly than directory group membership. ISM-1939 is a specific application of least privilege to a particular class of privileged groups.
This control depends on E8-RA-ML1.1.
ISM-1939 requires minimising the number of accounts that are members of highly privileged security groups. E8-RA-ML1.1 supports this by validating privileged access requests at the time they are first requested, reducing the likelihood of unnecessary approvals that would otherwise lead to additional highly privileged group memberships. E8-RA-ML1.1 is about access request governance rather than explicitly limiting group membership size.
- E8-RA-ML3.3Just-in-time administration is used for administering systems and applications.Depends on
This control depends on E8-RA-ML3.3.
ISM-1939 requires that organisations minimise the number of accounts in highly privileged groups (e.g. Domain Admins/Enterprise Admins). E8-RA-ML3.3 supports this by implementing just-in-time administration so users do not require standing membership in highly privileged groups to perform administrative tasks. E8-RA-ML3.3 focuses on time-bounded elevation rather than explicitly measuring or minimising group membership counts.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.