Essential Eight · strategy 4 of 8
Restrict administrative privileges
Validate, limit, review and log privileged access, keep privileged accounts away from email and the web, and separate privileged environments. The tables list the ISM controls ASD tags for this strategy at each maturity level; a level is reached only when every requirement at that level and below is met.
Patch applications · Patch operating systems · Multi-factor authentication · Restrict administrative privileges · Application control · Restrict Microsoft Office macros · User application hardening · Regular backups
Maturity Level One · 7 controls
| ISM control | Requirement (ASD's text) | Levels | Mapped to (ISO 27001, SOC 2, NIST CSF) |
|---|---|---|---|
| ISM-0445 | Privileged human users are assigned a dedicated privileged user account to be used solely for duties requiring privileged access. | ML1, ML2, ML3 | A.8.2 CC6.3 PR.AA-05 |
| ISM-1175 | Privileged user accounts (excluding those explicitly authorised to access online services) are prevented from accessing the internet, email and web services. | ML1, ML2, ML3 | A.8.2 CC6.3 PR.AA-05 |
| ISM-1380 | Privileged human users use separate privileged and unprivileged operating environments. | ML1, ML2, ML3 | A.8.2 CC6.3 PR.AA-05 |
| ISM-1507 | Requests for privileged access to systems and their resources are validated when first requested. | ML1, ML2, ML3 | A.8.2 CC6.3 PR.AA-05 |
| ISM-1688 | Unprivileged user accounts cannot be used to log on to privileged operating environments. | ML1, ML2, ML3 | — |
| ISM-1689 | Privileged user accounts (excluding local administrator accounts) cannot be used to log on to unprivileged operating environments. | ML1, ML2, ML3 | — |
| ISM-1883 | Privileged user accounts explicitly authorised to access online services are strictly limited to only what is required for users to undertake their duties or functions. | ML1, ML2, ML3 | — |
Maturity Level Two · 14 controls
| ISM control | Requirement (ASD's text) | Levels | Mapped to (ISO 27001, SOC 2, NIST CSF) |
|---|---|---|---|
| ISM-0445 | Privileged human users are assigned a dedicated privileged user account to be used solely for duties requiring privileged access. | ML1, ML2, ML3 | A.8.2 CC6.3 PR.AA-05 |
| ISM-1175 | Privileged user accounts (excluding those explicitly authorised to access online services) are prevented from accessing the internet, email and web services. | ML1, ML2, ML3 | A.8.2 CC6.3 PR.AA-05 |
| ISM-1380 | Privileged human users use separate privileged and unprivileged operating environments. | ML1, ML2, ML3 | A.8.2 CC6.3 PR.AA-05 |
| ISM-1387 | Administrative activities are conducted through jump servers. | ML2, ML3 | A.8.2 CC6.3 PR.AA-05 |
| ISM-1507 | Requests for privileged access to systems and their resources are validated when first requested. | ML1, ML2, ML3 | A.8.2 CC6.3 PR.AA-05 |
| ISM-1509 | Privileged access events are centrally logged. | ML2, ML3 | A.8.15 CC7.2 DE.AE-03 |
| ISM-1647 | Privileged access to systems and their resources are disabled after 12 months unless revalidated. | ML2, ML3 | A.8.2 CC6.3 PR.AA-05 |
| ISM-1648 | Privileged access to systems and their resources are disabled after 45 days of inactivity. | ML2, ML3 | A.8.2 CC6.3 PR.AA-05 |
| ISM-1650 | Privileged user account and security group management events are centrally logged. | ML2, ML3 | — |
| ISM-1685 | Credentials for break glass accounts, local administrator accounts and service accounts are long, unique, unpredictable and managed. | ML2, ML3 | — |
| ISM-1687 | Privileged operating environments are not virtualised within unprivileged operating environments. | ML2, ML3 | — |
| ISM-1688 | Unprivileged user accounts cannot be used to log on to privileged operating environments. | ML1, ML2, ML3 | — |
| ISM-1689 | Privileged user accounts (excluding local administrator accounts) cannot be used to log on to unprivileged operating environments. | ML1, ML2, ML3 | — |
| ISM-1883 | Privileged user accounts explicitly authorised to access online services are strictly limited to only what is required for users to undertake their duties or functions. | ML1, ML2, ML3 | — |
Maturity Level Three · 20 controls
| ISM control | Requirement (ASD's text) | Levels | Mapped to (ISO 27001, SOC 2, NIST CSF) |
|---|---|---|---|
| ISM-0445 | Privileged human users are assigned a dedicated privileged user account to be used solely for duties requiring privileged access. | ML1, ML2, ML3 | A.8.2 CC6.3 PR.AA-05 |
| ISM-1175 | Privileged user accounts (excluding those explicitly authorised to access online services) are prevented from accessing the internet, email and web services. | ML1, ML2, ML3 | A.8.2 CC6.3 PR.AA-05 |
| ISM-1380 | Privileged human users use separate privileged and unprivileged operating environments. | ML1, ML2, ML3 | A.8.2 CC6.3 PR.AA-05 |
| ISM-1387 | Administrative activities are conducted through jump servers. | ML2, ML3 | A.8.2 CC6.3 PR.AA-05 |
| ISM-1507 | Requests for privileged access to systems and their resources are validated when first requested. | ML1, ML2, ML3 | A.8.2 CC6.3 PR.AA-05 |
| ISM-1508 | Privileged access to systems and their resources is limited to only what is required for users to undertake their duties or functions. | ML3 | A.8.2 CC6.3 PR.AA-05 |
| ISM-1509 | Privileged access events are centrally logged. | ML2, ML3 | A.8.15 CC7.2 DE.AE-03 |
| ISM-1647 | Privileged access to systems and their resources are disabled after 12 months unless revalidated. | ML2, ML3 | A.8.2 CC6.3 PR.AA-05 |
| ISM-1648 | Privileged access to systems and their resources are disabled after 45 days of inactivity. | ML2, ML3 | A.8.2 CC6.3 PR.AA-05 |
| ISM-1649 | Just-in-time administration is used for the administration of systems and their resources. | ML3 | — |
| ISM-1650 | Privileged user account and security group management events are centrally logged. | ML2, ML3 | — |
| ISM-1685 | Credentials for break glass accounts, local administrator accounts and service accounts are long, unique, unpredictable and managed. | ML2, ML3 | — |
| ISM-1686 | Credential Guard functionality is enabled. | ML3 | — |
| ISM-1687 | Privileged operating environments are not virtualised within unprivileged operating environments. | ML2, ML3 | — |
| ISM-1688 | Unprivileged user accounts cannot be used to log on to privileged operating environments. | ML1, ML2, ML3 | — |
| ISM-1689 | Privileged user accounts (excluding local administrator accounts) cannot be used to log on to unprivileged operating environments. | ML1, ML2, ML3 | — |
| ISM-1861 | Local Security Authority protection functionality is enabled. | ML3 | — |
| ISM-1883 | Privileged user accounts explicitly authorised to access online services are strictly limited to only what is required for users to undertake their duties or functions. | ML1, ML2, ML3 | — |
| ISM-1897 | Remote Credential Guard functionality is enabled. | ML3 | — |
| ISM-1898 | Secure Admin Workstations are used in the performance of administrative activities. | ML3 | — |
Applies to every strategy
Logging and incident controls that ASD repeats under each strategy.
ML2: ISM-0123 ISM-0140 ISM-1228 ISM-1815 ISM-1819 ISM-1906
ML3: ISM-0109 ISM-0123 ISM-0140 ISM-1228 ISM-1815 ISM-1819 ISM-1906 ISM-1907
Control text: Australian Signals Directorate, Information Security Manual (September 2026). © Commonwealth of Australia, CC BY 4.0. Links to other frameworks are ControlMapping editorial (ASD publishes no crosswalk). Essential Eight guide · Gap analysis → Essential Eight