Key takeaways
- Restrict and manage admin-level access tightly.
- Admin accounts can do the most damage if misused or compromised.
- Start here: limit privileged access to those who need it.
Purpose
Restrict and manage admin-level access tightly.
Requirement
Requirement summaryThe allocation and use of privileged access rights shall be restricted and managed.
Why it matters
Admin accounts can do the most damage if misused or compromised.
How to implement
- Limit privileged access to those who need it.
- Use separate admin accounts from everyday accounts.
- Require MFA and approval for privileged access.
- Review privileged accounts frequently and log their use.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 8.2. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your rules for administrator (privileged) access: who gets it and how it is controlled.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.8.2 marked as used or not used, a short reason, and its current status.
Records and examples to show
- A list of all administrator accounts, each with a reason and approval.
- Records of regular reviews of administrator access.
- Settings showing admins use separate accounts and multi-factor login.
Things you should be able to show or explain
- Administrators should be able to explain when they use their admin account.
How much to show: All admin accounts on key systems.
Common mistakes
- Too many administrators.
- Everyday work done with admin accounts.
- Everyone in engineering has production admin.
- Admins browsing the web with privileged accounts.
- Tip: Separate admin accounts from everyday accounts.
Policies & documents to have
- Access Control Policy
FAQ
Is A.8.2 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.8.2?
Be ready to explain how the control works in your organisation and to provide things like: Your rules for administrator (privileged) access: who gets it and how it is controlled…