ASD ISM 2049 Enforcing re-authentication after permission changes
What it says
When user permissions or credentials are changed, software forces all impacted users to re-authenticate.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUsers must log in again if their account permissions change.
If a user's access levels or passwords change, they have to log in again to confirm their identity. This is important because if someone's permissions are updated, like giving them more access or changing their username, it could mean a security risk if it's not really them or their access isn't needed anymore.
Free. Save your status, tasks and notes.
Why it matters
If users aren't forced to re-authenticate after permission or credential changes, old sessions may retain access and enable unauthorised activity.
How to implement
The IT team should set up the system to automatically require users to sign in again whenever their access permissions are changed.
Use the system's settings or an external application that immediately prompts users to re-enter their credentials, ensuring only authorised people can continue using modified access rights.
Managers should regularly review who has access to what within the organisation.
This can be done by holding monthly meetings where they confirm that current roles and permissions reflect the team's present needs, and any changes immediately trigger re-authentication requirements.
HR should inform the IT team immediately when there's a change in employee status, like a promotion or department transfer.
This notification can be via an email or a collaboration tool message that includes the details for adjusting access levels and ensuring the proper re-authentication protocols are triggered.
Software developers should build functionality into their applications that automatically logs users out upon detecting permission changes.
This involves including code that will detect alterations in user profiles and enforce session termination until credentials are verified again.
Business leaders should have policies in place outlining the importance of re-confirming user identities after changes in permissions.
This can be achieved by drafting clear organisation-wide rules that explain why re-authentication is critical and ensuring all staff is trained on this policy during onboarding.
Keep it running
Expire sessions and require immediate re-authentication for all affected accounts whenever permissions, roles, passwords or MFA settings change.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A log of recent permission changes and sessions: Request a record showing when permissions were adjusted and corresponding user re-authentication attempts.
Look at
Timestamps to verify that every permission change triggered a re-authentication.
Good evidence
Is a seamless match between permission change logs and re-authentication entries.
- Check 2 of 5What an auditor asks for
Ask for
A settings overview or system configuration documentation: Request evidence of the system setup enforcing re-authentication on permission changes.
Look at
The specific configurations ensuring this practice is in place.
Good evidence
Would show documented system settings or configurations that enforce re-login on access changes.
- Check 3 of 5What an auditor asks for
Ask for
User feedback or reports on re-authentication: Request any surveys or incident reports that reflect user experience with re-authentication processes.
Look at
Comments about how permission changes were communicated and re-authentication was handled.
Good evidence
Shows consistent positive feedback or clear resolutions to any reported problems.
- Check 4 of 5What an auditor asks for
Ask for
IT policies related to account access management: Request the policy documents describing the procedure when user permissions change.
Look at
Sections detailing immediate re-authentication requirements after adjustments.
Good evidence
Includes a clear policy statement mandating re-authentication and guidelines on how it is handled.
- Check 5 of 5What an auditor asks for
Ask for
Training materials or records of staff education on re-authentication: Request evidence that staff are educated on the importance of re-authentication after permission changes.
Look at
The training content and attendance records to confirm regular sessions and comprehensive coverage.
Good evidence
Shows a documented training program with regular updates and broad participation.
Mappings
Closest match in ISO/IEC 27001: A.5.18, Managing access rights to information assets, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.18.
ISM-2049 requires that when user permissions or credentials change, all impacted users are forced to re-authenticate so existing sessions/tokens cannot retain outdated access. Annex A 5.18 requires access rights to be provisioned, reviewed, modified and removed under an access control policy, which includes ensuring changes take effect appropriately. ISM-2049 is a specific technical enforcement mechanism that supports correct application of modified access rights, whereas Annex A 5.18 is broader across the full access-rights management lifecycle.
This control partially overlaps A.8.5.
ISM-2049 requires software to invalidate existing authentication state and force re-authentication after permission or credential changes. Annex A 8.5 requires implementing secure authentication technologies and procedures based on access restrictions, which can include session management, token invalidation and re-authentication triggers. They overlap on authentication/session controls, but Annex A 8.5 is broader and principles-based, while ISM-2049 is a specific requirement tied to permission/credential change events.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.