ASD ISM 2048 Restrict non-admins from changing permissions
What it says
Where software supports multiple user roles, non-administrative users are prevented from altering their profile permissions or privileges.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishNon-admin users can't change their own permissions or privileges in software with multiple user roles.
This control means that people who aren't administrators shouldn't be able to change their own permissions in software that has different user roles. It's important because if non-administrators could change their own permissions, they might get access to sensitive information they shouldn't see.
Free. Save your status, tasks and notes.
Why it matters
If non-admin users can alter their own permissions, they may self-escalate privileges, access restricted data, and tamper with system settings, causing a breach or outage.
How to implement
Business owners should ensure that their IT provider configures software with strict user roles.
This means only administrators can change permissions, which limits the risk of unauthorised access.
The IT team should review user roles and permissions regularly to ensure only those with administrative duties have the ability to adjust permissions.
They can do this by accessing the user management settings in each system.
Office managers should coordinate with IT to conduct training sessions for staff members about the importance of role-based access.
Make sure everyone understands who can change permissions and why certain restrictions are in place.
System administrators should implement logging and monitoring to track any changes to user permissions.
Use security features in the software to set up alerts for any unauthorised changes.
HR managers should collaborate with IT to ensure that when staff roles change, their access permissions are updated immediately.
Use a checklist process during onboarding and offboarding to guarantee the right permissions are in place for each user role.
Keep it running
Verify non-admin roles cannot edit their own role memberships or privileges; routinely review access controls and test that permission-change functions are restricted to administrators.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The current list of user roles and permissions.
Look at
Who has administrative rights and check that these roles are limited to necessary personnel only.
Good evidence
Looks like a concise list with roles clearly defined and administrators identified by job title.
- Check 2 of 5What an auditor asks for
Look at
The logs for any unexpected changes made by non-administrators.
Good evidence
Shows logs with no unauthorised changes.
- Check 3 of 5What an auditor asks for
Ask for
To see the procedure document or policy detailing how user roles are managed.
Look at
The steps involved in adding or removing user roles and the approval process.
Good evidence
Includes clear, documented procedures that match observed practices.
- Check 4 of 5What an auditor asks for
Look at
The attendance records and the content covered in the training.
Good evidence
Shows that users are educated on their roles and responsibilities regularily.
- Check 5 of 5What an auditor asks for
Ask for
Evidence of regular audits or reviews of user permissions.
Look at
Reports that detail the findings and any corrective actions taken.
Good evidence
Includes regularly updated audit reports with documented responses to any issues found.
Mappings
Closest match in ISO/IEC 27001: A.5.15, Access control policies and procedures, which this control partially meets.
ISO/IEC 27001: 5 mappings
This control partially meets A.5.15.
ISM-2048 requires a specific access control outcome: non-admin users are blocked from changing their own permissions or privileges in role-based systems. ISO/IEC 27001:2022 Annex A 5.15 relates by requiring organisations to establish and implement access control policies and procedures that would define who is authorised to change permissions and how changes are approved. Annex A 5.15 is broader because it addresses policy and procedural controls across physical and logical access, while ISM-2048 is a targeted technical restriction within applications.
This control partially meets A.8.2.
ISM-2048 requires that non-administrative users are prevented from altering their own profile permissions or privileges in software that supports multiple roles. ISO/IEC 27001:2022 Annex A 8.2 relates by requiring privileged access rights to be restricted and managed, which commonly includes preventing self-service privilege changes by non-admins. Annex A 8.2 is broader because it covers the allocation, use, and governance of privileged rights across the organisation, not just the specific control of blocking non-admin self-modification in applications.
This control partially meets A.8.3.
ISM-2048 requires that non-administrative users cannot alter their own permissions or privileges where multiple user roles exist. ISO/IEC 27001:2022 Annex A 8.3 relates by requiring access to information and assets to be restricted in line with an access control policy, which includes preventing unauthorised privilege changes. Annex A 8.3 is broader because it covers restriction of access generally, whereas ISM-2048 focuses specifically on stopping role/permission self-modification by non-admin users.
This control depends on A.5.3.
Annex A 5.3 requires segregation of conflicting duties so users cannot combine roles that enable misuse or bypass of oversight. ISM-2048 supports this by preventing non-administrative users from altering their own permissions, which helps maintain separation between request/approval/provisioning and self-service privilege escalation. ISM-2048 focuses on a specific application/role capability (self-modification of privileges), whereas Annex A 5.3 also covers broader organisational separation such as initiator/approver and operator/auditor splits.
This control depends on A.5.18.
Annex A 5.18 requires controlled provisioning and modification of access rights in accordance with access control rules. ISM-2048 supports this by preventing non-administrative users from altering their own permissions or privileges, ensuring changes occur through authorised access-rights management processes. ISM-2048 is a preventative technical control, while Annex A 5.18 is the overarching requirement for lifecycle management and governance of access rights.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.