Control A.8.18Use of privileged utility programs
The use of utility programs that can be capable of overriding system and application controls must be restricted and tightly controlled.
Utility programs are the tools that operate beneath the application’s own controls — direct database clients, disk and memory tools, debuggers, administrative scripts and diagnostic software. They can read and change what the application would refuse, and they usually leave less trace.
The control asks for their use to be restricted to the people who need them, authorised, logged, and where possible removed from systems that do not require them.
It is the technical counterpart of A.8.2: restricting privileged accounts achieves little if a tool on the host bypasses the mechanism the account is checked by.
The modern version of this problem is administrative and automation tooling — configuration management agents, remote support software and orchestration platforms — which is powerful by design, often installed everywhere, and frequently treated as infrastructure rather than as the privileged access path it is.
How to put this in place
Some tools can override normal controls, such as system utilities, database admin tools and remote administration software. Your ISMS needs to know where they are and who can use them, since misuse of them often goes unseen.
- Identify the utility programs that can bypass controls in your estate.
- Decide who may use each one and for what purpose.
- Restrict them to authorised administrators and remove them where not needed.
- Log their use and alert on the first run of a restricted utility on a system where it should not appear.
Evidence an auditor usually looks for: the list of restricted utilities, installation and access restrictions, and usage logs.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.