Control A.8.2Privileged access rights
The allocation and use of privileged access rights must be restricted and managed.
Privileged access is the access that defeats the other controls, which is why it gets its own control separate from A.5.18’s general rights management.
The expectations are a small, justified population; allocation by a defined authorisation process rather than by habit; separate credentials for privileged use so that everyday work does not run with elevated rights; logging of privileged activity under A.8.15; and review more often than ordinary access.
The strongest implementations remove standing privilege entirely — access granted for a task, for a period, and withdrawn automatically. That is also what makes the logs meaningful, since an elevation is an event with a reason attached.
The chronic weakness is the accounts nobody owns: shared administrative credentials, vendor support accounts, and service accounts with broad rights and passwords set years ago. Each is privileged access with no individual attributable to it, which is what A.5.16 is trying to prevent.
How to put this in place
Administrator accounts can change or read almost anything, so attackers go for them first. Your ISMS needs a short, known list of privileged accounts that are controlled and watched, or one stolen password becomes a full breach.
- List every privileged account and name an owner for each.
- Decide who may hold administrator rights and how they are approved.
- Move admin work to separate named accounts with multi-factor authentication, and time-limit rights where you can.
- Log privileged activity and keep shared admin passwords out of use.
- Review the privileged list at least every three months and remove what is not needed.
Evidence an auditor usually looks for: the privileged account list with owners and approvals, review records, and administrator activity logs.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.
Stage 1 and Stage 2 Audit Preparation GuideWord
Listed among the commonly sampled controls, with what an auditor is likely to sample and the likely challenge.