PRO-12 Least privilege access
3 actions under this Protect principle in Essentials for enterprise IT. Each action links to plain-English guidance, audit tips and cross-framework mappings.
ASD principle statement
Users are granted the minimum access to systems (infrastructure, operating systems, applications and data) required to undertake their duties or functions.
Quoted as published. Everything else on this page is written by Control Stack.
The three actions
- IT.PRO-12.1Periodically Review and Update Access Privileges to Match Current Roles and Duties
Reviews each account's access on a set cycle and updates it to match current roles, duties and business needs.
Domains:All six technical domains (Boundary services, Identity services, Critical processes and services, Privileged environments, Business systems, User devices) - IT.PRO-12.2Restrict Account and Role Management and Privileged Functions to Authorised Administrative Roles
Lets only authorised admin roles create, change or delete accounts and roles, or use admin functions and applications.
Domains:Boundary servicesIdentity servicesCritical processes and servicesPrivileged environments - IT.PRO-12.3Provision User, Administrative and Non-Person Accounts with Minimum Required Privileges
Gives every account, whether used by staff, admins, apps or systems, only the minimum access its defined tasks need.
Domains:Boundary servicesIdentity servicesCritical processes and servicesPrivileged environments
Back to the full ASD Essentials for enterprise IT action list, or browse the complete control library.