Restrict admin privileges

search account_circle

boltEssential 8

Restrict admin privileges

29 controls in this part of theEssential Eight. Each control links to plain-English guidance, audit tips and cross-framework mappings.

Validating privileged access requests upon initial request

Check and approve requests for admin access to systems and data at the start.

Dedicated privileged accounts for admin tasks

Ensure admins use special accounts only for their admin work.

Prevent privileged accounts from accessing internet, email, and web services

Block admin accounts from internet and email to enhance security.

Limit privileged accounts to essential online service access

Only allow privileged accounts the minimum access needed for online duties.

Privileged users use separate privileged and unprivileged environments

Ensure privileged users have separate work environments for admin tasks and regular tasks.

Unprivileged accounts restricted from logging into privileged environments

Ensure that non-admin accounts cannot access admin-level systems.

Prevent privileged accounts from accessing unprivileged environments

Ensure privileged accounts can't be used in unsecured setups to limit risk.

Disable privileged access after 12 months without revalidation

Ensure privileged access is reviewed and renewed annually for continued access.

Privileged access is disabled after 45 days of inactivity

Disable admin accounts if unused for 45 days to improve security.

Privileged environments are not virtualised within unprivileged environments

Ensure that secure environments are not run within less secure ones.

Conduct administrative activities through jump servers

Require admins to use secure jump servers for management tasks.

Long, unique, and managed credentials for admin accounts

Ensure admin account credentials are strong, unique, and well-managed.

Privileged access events are centrally logged.

Keep logs of admin actions in a central place to monitor for misuse.

Centrally log privileged account and group management events

Ensure logs of admin account and group changes are stored in one place.

Event logs are protected from unauthorised changes and losses

Ensure event logs cannot be changed or deleted without authorisation.

Event logs are analysed promptly for security events

Quickly check logs from servers open to the internet for security issues.

Timely analysis of cyber security events to identify incidents

Quickly review cyber events to spot security incidents.

Report cyber incidents to the CISO promptly

Report security incidents to the security officer quickly after finding them.

Report cyber security incidents to ASD promptly

Notify ASD quickly about any cyber attacks or breaches.

Enact cyber incident response plan after an incident is identified

Start the response plan immediately after a cyber incident is detected.

Limit privileged access to what is necessary for duties

Ensure privileged access is granted only when needed to perform specific duties.

Use Secure Admin Workstations for Administrative Tasks

Conduct admin activities on secure, dedicated workstations only.

Just-in-time administration is used for administering systems and applications.

Grant high-level access only when needed and for limited times to enhance security.

Memory integrity functionality is enabled

Ensure features that protect memory from exploits are enabled to prevent unauthorized code execution

Local Security Authority protection functionality is enabled

Ensure LSA protection is on to prevent malware from stealing credentials.

Enable Credential Guard for secure credential storage

Enable Credential Guard to protect credentials from attacks by isolating them.

Enable Remote Credential Guard functionality

Prevent admin credentials from being exposed during remote logins.

Timely analysis of event logs from non-internet-facing servers

Review logs of internal servers promptly to spot security threats.

Timely analysis of workstation event logs for security events

Regularly check logs on office computers to find security issues early.

Back to the full ASD Essential Eight control list, or browse the complete control library.