8.2 Privileged access rights
The granting and use of privileged access rights are to be limited and managed. Purpose: limit privileged access to the people, software components and services that are authorized for it. Guidance: allocate privileged rights through an authorization process under the access control policy (5.15), considering: identifying who needs privileged access for each system or process, whether an operating system, a database platform or an application; granting it as needed and per event, only to people competent to carry out the privileged activity and at the minimum their role requires; keeping an authorization process (who may approve, and no privilege before approval) and a record of all privileges granted; defining and applying expiry of privileged rights; making users aware of their privileges and of when they are operating in privileged mode, using dedicated identities, interface settings or even separate equipment; stronger authentication than for normal access, possibly re-authentication or step-up before privileged work; reviewing privileged users regularly and after organizational change to confirm their duties, role and competence still justify it (5.18); rules to avoid generic administrator accounts such as root where systems allow, and protecting their credentials (5.17); temporary elevation only for the window needed to carry out an approved change or activity instead of standing privilege, often called break glass and frequently automated by privileged access management tools; logging all privileged access for audit; never sharing privileged identities among several people, giving each person a separate identity, though identities may be grouped to simplify management; and using privileged identities only for administration, never for everyday tasks like email or browsing, for which a separate normal identity is used. Other information: privileged rights let an identity, role or process do what ordinary users or processes cannot, as system administrators typically need; abuse of administrator powers able to bypass system or application safeguards is a leading cause of failures and breaches; ISO/IEC 29146 gives further guidance.
Source: ISO/IEC 27002:2022, 8.2. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO/IEC 27002:2022 in the compliance library.
ISO/IEC 27002 is guidance on the Annex A controls; certification is against ISO/IEC 27001. Use this set when your sheet follows the 27002 numbering.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
- An inventory of privileged accounts per system (operating systems, databases, applications, cloud consoles) mapped to named individuals · Identity provider / directory
- Privileged access management configuration showing time-limited elevation, step-up authentication and session recording · Identity provider / directory
- Logs of privileged access retained for audit · Identity provider / directory
periodic reviewEvidence produced at each review
- Authorization records for each privileged grant with approver, justification and expiry · Identity provider / directory
- Privileged access review records performed periodically and after organizational changes · Identity provider / directory
- Evidence that administrators use separate accounts for administration and for email and browsing, and that generic accounts such as root are controlled · Identity provider / directory
governing documentDocuments that govern the control
none for this control
First move
Common gaps auditors find
- Administrators use their privileged account for email and web browsing
- Shared generic administrator accounts are used with no individual accountability
- Privileged rights are standing and never expire
- Service accounts with administrative rights are excluded from reviews
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet8.1 User endpoint devices · 8.3 Information access restriction