Use of privileged utility programs
Purpose
Keep tight control over utility programs powerful enough to bypass normal system and application safeguards.
How to meet this control
In short: Restrict and tightly control utility programs that can override controls.
- Step 01Identify powerful utilities and tooling that can override system or application controls and inventory who can run them
- Step 02Restrict execution to a minimal group of trusted administrators and remove or disable utilities that are not needed
- Step 03Require authentication and explicit, recorded authorisation before privileged utilities are used, ideally just-in-time
- Step 04Keep utility access separate from staff who operate the applications where segregation of duties applies
- Step 05Make utilities available only for the window of an approved change rather than permanently
- Step 06Log every invocation of a privileged utility and review the logs for unexpected use
Tip: Limit and log use of powerful admin tools.
What ISO 27002 says to cover
Reference points from the ISO/IEC 27002:2022 guidance for this control. Use them to check the steps above cover everything relevant to you.
- ›Restrict use of override-capable utilities to the smallest possible group of trusted people
- ›Require identification, authentication and authorisation before any utility runs
- ›Define and document authorisation levels and require sign-off for ad hoc use
- ›Do not give utility access to users who also work with applications where duties must be separate
- ›Remove or disable any utility programs that are not needed
- ›Keep utilities logically separate from application software
- ›Limit when utilities are available, for example only for the window of an approved change
- ›Log every use of utility programs
Audit evidence to keep
- - Inventory of privileged utilities and authorised users
- - Authorisation records for utility use tied to approved changes
- - Configuration showing unneeded utilities removed or disabled
- - Logs of privileged utility execution
- - Evidence segregation of duties is enforced for utility access
Common mistakes
- - Approving access in chat with no retained record
- - Copying access from another user without checking least privilege
- - Reviewing access but not proving removals were completed
Owner, cadence, and proof
Assign one accountable owner for A.8.18. Review this control at least annually, after related incidents, and whenever the underlying process, supplier, system, office, or legal obligation changes. The control is audit-ready when the owner can show the policy or procedure, the latest operating evidence, the latest review, and any open exceptions with due dates.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.