PRO-05 · Protect

Secure administration

Systems (infrastructure, operating systems, applications and data) are administered in a secure, accountable and auditable manner.

Enterprise IT actions

• IT.PRO-05.1

  Ensure administrative activities can only be performed from dedicated and hardened environments that are isolated from unprivileged user workloads.

  • Phase 1Boundary services, Identity services
  • Phase 2Critical processes and services, Privileged environments
  ASD’s indicators

  Not effective

  • Administrative access to systems is routinely performed from standard user devices without additional controls to protect the administrative session.
  • No dedicated or hardened administrative environment exists.
  • Exceptions to the use of dedicated administrative environments are neither identified nor assessed.

  Partially effective

  • A dedicated administrative environment has been established, but administrative access is not consistently routed through it.
  • Administrative endpoints have been hardened, but unprivileged user workloads or unnecessary functions remain accessible.
  • Exceptions are documented, but their justification, risk acceptance, compensating controls or review arrangements are incomplete or inconsistently applied.

  Fully effective

  • Administrative sessions originate from dedicated and hardened administrative environments that are isolated from unprivileged user workloads. Where this cannot be technically enforced, exceptions are documented, risk-assessed, formally accepted and protected by compensating controls.
  • Administrative environments are hardened and restricted to the functions required for authorised administration.
  • Exceptions are limited to systems or services that cannot support administration through a dedicated environment, are periodically reviewed and are removed when the technical limitation no longer applies.
  Related frameworks

  ISM

  ISM-1385

  NIST CSF 2.0

  PR.AA-05, PR.IR-01, PR.PS-01, PR.IR-02

  NIST SP 800-171r3

  03.01.06, 03.04.06, 03.13.01, 03.01.12

  AESCSF v2

  ARCHITECTURE-3c, ARCHITECTURE-2e, ARCHITECTURE-2d

  Essential Eight

  Restrict administrative privileges

  MITRE ATT&CK

  T1068 Exploitation for Privilege Escalation, T1003 OS Credential Dumping

  Rate this action in the Navigator →
• IT.PRO-05.2

  Enforce explicit session establishment controls before privileged actions are permitted, including the use of time-bound privilege grants.

  • Phase 1Boundary services, Identity services
  • Phase 2Critical processes and services, Privileged environments
  ASD’s indicators

  Not effective

  • Privileged access is standing and does not require explicit activation or time-bound grants, excluding approved break-glass and emergency access accounts.
  • No re-authentication or step-up authentication is required before privileged sessions.

  Partially effective

  • Time-bound access is implemented for some privileged roles but standing access remains for others.
  • Session duration limits exist but are not consistently enforced or are set excessively long.

  Fully effective

  • Time-bound privilege grants are enforced for applicable privileged roles, with defined maximum session durations and approved emergency access arrangements.
  • Re-authentication or step-up authentication is required before privilege activation.
  • All privilege activations are logged with activating user, role and timeframes.
  Related frameworks

  NIST CSF 2.0

  PR.AA-03, PR.AA-04, PR.AA-05

  NIST SP 800-171r3

  03.01.12, 03.05.03, 03.01.11

  AESCSF v2

  ACCESS-1g, ACCESS-2g, ACCESS-1h

  Essential Eight

  Restrict administrative privileges

  MITRE ATT&CK

  T1003 OS Credential Dumping, T1550 Use Alternate Authentication Material, T1558 Steal or Forge Kerberos Tickets

  Rate this action in the Navigator →
• IT.PRO-05.3

  Record all administrative or management actions that modify systems, configurations or controls, including the details of the associated user, timestamp and target.

  • Phase 1Boundary services, Identity services
  • Phase 2Critical processes and services, Privileged environments
  ASD’s indicators

  Not effective

  • Administrative or management actions that modify systems, configurations or controls are not logged.
  • Logs do not capture sufficient detail to identify who made a change, when and to what target.

  Partially effective

  • Logging is enabled and provides useful coverage, but does not cover all applicable administrative or management platforms.
  • Logs capture the administrator identity and action but lack detail on the target or change nature.

  Fully effective

  • Comprehensive audit logging to capture all administrative or management actions is enabled on all platforms in scope.
  • Logs capture administrator identity, timestamp, target object and nature of change.
  Related frameworks

  ISM

  ISM-0585, ISM-1566

  NIST CSF 2.0

  PR.PS-04, DE.CM-03, DE.AE-03

  NIST SP 800-171r3

  03.01.07, 03.03.01, 03.03.02, 03.03.03

  AESCSF v2

  SITUATION-1a, ASSET-4i, ACCESS-2i

  Essential Eight

  Restrict administrative privileges

  MITRE ATT&CK

  T1685 Disable or Modify Tools, T1112 Modify Registry, T1136 Create Account, T1543 Create or Modify System Process

  Rate this action in the Navigator →

Operational technology actions

• Action 1

  Manage supporting site infrastructure from a dedicated management network within the most critical network to which it is connected.

  • Phase 2Privileged environments, Identity services
  Rate this action in the Navigator →
• Action 2

  Ensure administrative, engineering and troubleshooting access to OT can only be initiated from dedicated and hardened environments that are isolated from unprivileged workloads and located in a segment of equal or greater trust than the system being administered.

  • Phase 1Critical processes and services
  • Phase 2Privileged environments
  Rate this action in the Navigator →

Cloud actions

• Action 1

  Ensure administrative activities against cloud management planes are performed only from managed, compliant, hardened devices.

  • Phase 1Identity services, Boundary services
  • Phase 2Critical processes and services, Privileged environments
  • ResponsibilityPaaS: Customer, SaaS: Customer
  Rate this action in the Navigator →
• Action 2

  Enforce explicit privilege activation before privileged actions are permitted, with approved and time-bound elevation limited to the functions required, and monitor privileged sessions and test response arrangements.

  • Phase 1Identity services, Boundary services
  • Phase 2Critical processes and services, Privileged environments
  • ResponsibilityPaaS: Supplied, SaaS: Supplied
  Rate this action in the Navigator →
• Action 3

  Record all administrative or management actions that modify cloud services, configurations or controls with the details of the identity, timestamp and target.

  • Phase 1Identity services, Boundary services
  • Phase 2Critical processes and services, Privileged environments
  • Phase 3Business systems
  • ResponsibilityPaaS: Supplied, SaaS: Supplied
  Rate this action in the Navigator →

Open the Navigator →

More Protect principles

• PRO-01Secure system lifecycle
• PRO-04Secure configuration management
• PRO-06Vulnerability management
• PRO-07Trustworthy software
• PRO-08Cryptographic protection
• PRO-09Content filtering
• PRO-10Regular and proven backups
• PRO-12Least privilege access
• PRO-13Identity, credential and access management
• PRO-14Cyber security awareness training
• PRO-15Physical access control
• PRO-16Cyber supply chain security
• PRO-18Network segmentation and segregation
• PRO-19Operational technology isolation
• PRO-20Remote access to operational technology

Source: ASD Essentials for enterprise IT, version 2026.10.15; ASD Essentials for operational technology, version 2026.10.15; ASD Essentials for cloud, version 2026.10.15, Australian Signals Directorate. The Navigator is an independent project and is not affiliated with or endorsed by the Australian Signals Directorate.