The ultimate audit guide to ISO 27001 Annex A 8.18 Use of Privileged Utility Programs
Table of contents
- 1. Privileged Utility Program Identification Verified
- 2. Utility Program Access Authorisation Confirmed
- 3. Usage Justification and Timely Access Validated
- 4. Utility Program Segregation from Production Verified
- 5. Independent Audit Logging of Utility Execution Confirmed
- 6. Automated Execution Alerting Validated
- 7. Integrity of Utility Program Files Verified
- 8. Utility Program Removal Records Identified
- 9. Multi-Factor Authentication (MFA) for Execution Confirmed
- 10. Periodic Utility Access Review Recorded
1. Privileged Utility Program Identification Verified
Verification Criteria: A definitive list of utility programs capable of overriding system and application security controls (e.g. packet sniffers, disk editors, registry tools) is documented and maintained.
Required Evidence: Software Inventory or Allow-list explicitly identifying “Privileged Utilities” and their business owners.
Pass/Fail Test: If the organisation cannot produce a list of authorised high-privilege utilities currently installed in the environment, mark as Non-Compliant.
2. Utility Program Access Authorisation Confirmed
Verification Criteria: Access to privileged utility programs is restricted to the minimum number of authorised users required for specific maintenance or security tasks.
Required Evidence: Identity and Access Management (IAM) role definitions or Group Policy Object (GPO) reports showing restricted execution rights.
Pass/Fail Test: If standard user accounts (non-admin) have the technical ability to execute system-level utility programs, mark as Non-Compliant.
3. Usage Justification and Timely Access Validated
Verification Criteria: The use of privileged utilities is granted on a “Just-in-Time” (JIT) basis or requires a formalised request linked to a specific change or maintenance window.
Required Evidence: Approved Change Request (CR) tickets or JIT elevation logs from a Privileged Access Management (PAM) tool.
Pass/Fail Test: If administrators have standing, unmonitored access to execute privileged utilities at all times without a recorded business reason, mark as Non-Compliant.
DO IT YOURSELF
ISO 27001
All the templates, tools, support and knowledge you need to do it yourself.
4. Utility Program Segregation from Production Verified
Verification Criteria: Privileged utility programs are removed from production systems or disabled when not actively required for a specific maintenance task.
Required Evidence: Server hardening build standards and physical confirmation of the absence of non-essential tools in production images.
Pass/Fail Test: If high-impact utilities (e.g. Wireshark or hex editors) are found pre-installed on standard production web or database servers, mark as Non-Compliant.
5. Independent Audit Logging of Utility Execution Confirmed
Verification Criteria: Every instance of a privileged utility program being executed is recorded in an immutable central log that is separate from the local system log.
Required Evidence: SIEM logs or Syslog exports showing “Process Execution” events specifically for identified privileged utilities.
Pass/Fail Test: If a privileged utility can be run without generating a tamper-proof audit trail in a central repository, mark as Non-Compliant.
6. Automated Execution Alerting Validated
Verification Criteria: The execution of high-risk privileged utilities triggers a real-time alert to the security team or SOC for immediate oversight.
Required Evidence: SIEM correlation rule configuration and corresponding alert history for “High-Risk Utility Execution.”
Pass/Fail Test: If a disk-level utility is executed on a production server and no security alert is generated for the SOC, mark as Non-Compliant.
7. Integrity of Utility Program Files Verified
Verification Criteria: Measures are in place to ensure that authorised utility programs have not been tampered with or replaced by malicious binaries (e.g. via hashing or signing).
Required Evidence: File Integrity Monitoring (FIM) logs or AppLocker “Publisher” rules verifying the digital signatures of the tools.
Pass/Fail Test: If the organisation cannot verify that the privileged utilities currently in use match the original manufacturer’s hash or signature, mark as Non-Compliant.
8. Utility Program Removal Records Identified
Verification Criteria: Decommissioned or unauthorised utility programs are formally removed from the environment and confirmed via technical scans.
Required Evidence: Vulnerability scan reports or software audit logs showing the successful removal of “shadow” or legacy utilities.
Pass/Fail Test: If a previously “banned” utility is detected during a scan and has not been remediated within the policy-defined SLA, mark as Non-Compliant.
9. Multi-Factor Authentication (MFA) for Execution Confirmed
Verification Criteria: Launching a privileged utility program requires a second factor of authentication or a “Four-Eyes” approval process for critical actions.
Required Evidence: PAM tool configuration showing MFA prompts or secondary approval workflows for executing high-privilege binaries.
Pass/Fail Test: If a compromised administrator account can execute a disk-wiping utility using only a password, mark as Non-Compliant.
10. Periodic Utility Access Review Recorded
Verification Criteria: Management performs a formal review of the users authorised to execute privileged utility programs at regular intervals (e.g. quarterly).
Required Evidence: Signed Access Review reports cross-referencing authorised users against current job roles and project requirements.
Pass/Fail Test: If the list of users authorised to use high-impact utilities has not been reviewed and re-approved in the last six months, mark as Non-Compliant.
About the author
