Privileged access rights

What the requirement asks

The granting and use of privileged access rights are to be limited and managed. Purpose: limit privileged access to the people, software components and services that are authorized for it. Guidance: allocate privileged rights through an authorization process under the access control policy (5.15), considering: identifying who needs privileged access for each system or process, whether an operating system, a database platform or an application; granting it as needed and per event, only to people competent to carry out the privileged activity and at the minimum their role requires; keeping an authorization process (who may approve, and no privilege before approval) and a record of all privileges granted; defining and applying expiry of privileged rights; making users aware of their privileges and of when they are operating in privileged mode, using dedicated identities, interface settings or even separate equipment; stronger authentication than for normal access, possibly re-authentication or step-up before privileged work; reviewing privileged users regularly and after organizational change to confirm their duties, role and competence still justify it (5.18); rules to avoid generic administrator accounts such as root where systems allow, and protecting their credentials (5.17); temporary elevation only for the window needed to carry out an approved change or activity instead of standing privilege, often called break glass and frequently automated by privileged access management tools; logging all privileged access for audit; never sharing privileged identities among several people, giving each person a separate identity, though identities may be grouped to simplify management; and using privileged identities only for administration, never for everyday tasks like email or browsing, for which a separate normal identity is used. Other information: privileged rights let an identity, role or process do what ordinary users or processes cannot, as system administrators typically need; abuse of administrator powers able to bypass system or application safeguards is a leading cause of failures and breaches; ISO/IEC 29146 gives further guidance. In the ISMS the control is compared with the controls determined in risk treatment and recorded in the Statement of Applicability as included or excluded, with the reason and the implementation status.

What the guidance adds

Privileged access needs more control than ordinary access. The guidance asks for the inventory, the approval, the session record and the review.

What good looks like

Put the control in the Statement of Applicability with an owner, a status and the risk it treats. Then keep an inventory of privileged accounts per system (operating systems, databases, applications, cloud consoles) mapped to named individuals and one live sample together.

Evidence an assessor asks for

• Privileged access managementAn inventory of privileged accounts per system (operating systems, databases, applications, cloud consoles) mapped to named individuals
• Privileged access managementAuthorization records for each privileged grant with approver, justification and expiry
• Privileged access managementPrivileged access management configuration showing time-limited elevation, step-up authentication and session recording
• Privileged access managementPrivileged access review records performed periodically and after organizational changes
• Privileged access managementLogs of privileged access retained for audit
• Privileged access managementEvidence that administrators use separate accounts for administration and for email and browsing, and that generic accounts such as root are controlled

The question an assessor will ask

An assessor will ask for an inventory of privileged accounts per system (operating systems, databases, applications, cloud consoles) mapped to named individuals, then trace it to the system it protects. For A.8.2 the test is whether that record ties to a live sample, not whether the control is named in a policy.

Common gaps

• Administrators use their privileged account for email and web browsing
• Shared generic administrator accounts are used with no individual accountability
• Privileged rights are standing and never expire
• Service accounts with administrative rights are excluded from reviews

Before the next audit

Before the next audit, check one live sample for this gap: administrators use their privileged account for email and web browsing.