PRO-12 · Protect

Least privilege access

Users are granted the minimum access to systems (infrastructure, operating systems, applications and data) required to undertake their duties or functions.

Enterprise IT actions

• IT.PRO-12.1

  Periodically review and update access privileges in alignment with current roles, duties and business requirements.

  • Phase 1Boundary services, Identity services
  • Phase 2Critical processes and services, Privileged environments
  • Phase 3Business systems, User devices
  ASD’s indicators

  Not effective

  • Access privileges are not reviewed against current roles, duties and business requirements.
  • Access reviews do not identify privileges that are no longer required.
  • Access privileges are not updated when personnel roles, duties or business requirements change.
  • Access privileges are not mapped to roles, duties and business requirements.

  Partially effective

  • Access reviews are conducted for some accounts or systems, but coverage is incomplete.
  • Reviews identify excessive or obsolete privileges, but updates are incomplete or not completed within timeframes defined by the organisation.
  • A process to review access privileges exists but only occurs on an ad hoc basis.
  • Some access privileges are mapped to roles, duties and business requirements, but not all.

  Fully effective

  • Access privileges for all applicable accounts and systems are reviewed within a cycle defined by the organisation and aligned with current roles, duties and business requirements.
  • Privileges identified as excessive or obsolete are removed or updated within timeframes defined by the organisation.
  • Review outcomes and resulting access changes are documented and available as evidence.
  • Access privileges are mapped to current roles, duties and business requirements.
  Related frameworks

  ISM

  ISM-1852

  NIST CSF 2.0

  PR.AA-05, PR.AA-01, GV.RM-02

  NIST SP 800-171r3

  03.01.05, 03.01.01, 03.01.04

  AESCSF v2

  ACCESS-2h, ACCESS-2f, ACCESS-1e

  Essential Eight

  Restrict administrative privileges

  MITRE ATT&CK

  T1098 Account Manipulation

  Rate this action in the Navigator →
• IT.PRO-12.2

  Grant only authorised administrative roles permissions to create, modify or delete accounts and roles, and access privileged functions or applications.

  • Phase 1Boundary services, Identity services
  • Phase 2Critical processes and services, Privileged environments
  ASD’s indicators

  Not effective

  • Non-administrative users can create, modify or delete accounts or roles.
  • Delegated permissions are broad and have not been audited.

  Partially effective

  • Permissions are restricted to administrative roles but some delegated permissions are broader than required.
  • Approval workflows exist for some high-impact changes but not all.

  Fully effective

  • Only designated administrative roles can create, modify or delete accounts and roles.
  • Delegated permissions are audited and scoped to the minimum required.
  • Approval workflows are enforced for high-impact identity and access changes.
  Related frameworks

  ISM

  ISM-1584

  NIST CSF 2.0

  PR.AA-05, PR.AA-01, PR.AA-04

  NIST SP 800-171r3

  03.01.06, 03.01.07, 03.01.01, 03.04.05

  AESCSF v2

  ACCESS-2d, ACCESS-1g, ARCHITECTURE-3c

  Essential Eight

  Restrict administrative privileges

  MITRE ATT&CK

  T1136 Create Account, T1098 Account Manipulation

  Rate this action in the Navigator →
• IT.PRO-12.3

  Provision user, administrative and non-person accounts with only the minimum access and privileges required to perform defined operational functions.

  • Phase 1Boundary services, Identity services
  • Phase 2Critical processes and services, Privileged environments
  ASD’s indicators

  Not effective

  • Accounts are provisioned with broad default permissions that exceed operational requirements.
  • Administrative and day-to-day user functions share the same account, with no separate privileged accounts.

  Partially effective

  • Minimum privilege provisioning is defined but not consistently applied to all account types.
  • Administrative accounts are separated from user accounts but some exceptions exist without documented justification.

  Fully effective

  • All accounts are provisioned with documented minimum permissions aligned to defined operational functions.
  • Separate accounts are allocated for privileged and day-to-day functions, and controls prevent privileged use from day-to-day context.
  • Non-person and service accounts are scoped to their specific integration requirements.
  Related frameworks

  ISM

  ISM-1249, ISM-1619, ISM-1852

  NIST CSF 2.0

  PR.AA-05, PR.AA-01, PR.AA-03

  NIST SP 800-171r3

  03.01.05, 03.01.06, 03.01.02, 03.01.01

  AESCSF v2

  ACCESS-2d, ACCESS-1g, ACCESS-2c

  Essential Eight

  Restrict administrative privileges

  MITRE ATT&CK

  T1136 Create Account, T1098 Account Manipulation

  Rate this action in the Navigator →

Operational technology actions

• Action 1

  Establish and maintain a process to grant, track and periodically review approval of all remote access users, using secure protocols and restricting access to the minimum level required for the work being performed.

  • Phase 1Boundary services
  • Phase 2Identity services
  Rate this action in the Navigator →
• Action 2

  Provision administrative and privileged functions in OT as distinct roles, each assigned to a unique account with only the minimum access and privileges required to perform defined operational functions.

  • Phase 2Privileged environments, Identity services
  Rate this action in the Navigator →

Cloud actions

• Action 1

  Periodically review and update access privileges in alignment with current roles, duties and business requirements.

  • Phase 1Identity services, Boundary services
  • Phase 2Critical processes and services, Privileged environments
  • Phase 3Business systems
  • ResponsibilityPaaS: Supplied, SaaS: Supplied
  Rate this action in the Navigator →
• Action 2

  Restrict permissions to create, modify, or delete accounts and roles, or to access privileged functions or applications, to authorised administrative roles.

  • Phase 1Identity services, Boundary services
  • Phase 2Critical processes and services, Privileged environments
  • Phase 3Business systems
  • ResponsibilityPaaS: Supplied, SaaS: Supplied
  Rate this action in the Navigator →
• Action 3

  Provision user, administrative and non-person accounts with only the minimum access and privileges required to perform defined operational functions.

  • Phase 1Identity services, Boundary services
  • Phase 2Critical processes and services, Privileged environments
  • Phase 3Business systems
  • ResponsibilityPaaS: Supplied, SaaS: Supplied
  Rate this action in the Navigator →

Open the Navigator →

More Protect principles

• PRO-01Secure system lifecycle
• PRO-04Secure configuration management
• PRO-05Secure administration
• PRO-06Vulnerability management
• PRO-07Trustworthy software
• PRO-08Cryptographic protection
• PRO-09Content filtering
• PRO-10Regular and proven backups
• PRO-13Identity, credential and access management
• PRO-14Cyber security awareness training
• PRO-15Physical access control
• PRO-16Cyber supply chain security
• PRO-18Network segmentation and segregation
• PRO-19Operational technology isolation
• PRO-20Remote access to operational technology

Source: ASD Essentials for enterprise IT, version 2026.10.15; ASD Essentials for operational technology, version 2026.10.15; ASD Essentials for cloud, version 2026.10.15, Australian Signals Directorate. The Navigator is an independent project and is not affiliated with or endorsed by the Australian Signals Directorate.