ISO 27001 Annex A 8.2 Audit Checklist

The ultimate audit guide to ISO 27001 Annex A 8.2 Privileged Access Rights

1. Privileged Access Allocation Formalisation Verified

Verification Criteria: A documented process exists that defines the specific roles requiring privileged access and the criteria for allocation based on the principle of least privilege.

Required Evidence: Approved Access Control Policy or Privileged Access Management (PAM) procedure document.

Pass/Fail Test: If privileged access is granted without a documented business justification or formal approval record, mark as Non-Compliant.

2. Privileged User Inventory Accuracy Confirmed

Verification Criteria: A current and accurate list of all users with privileged access rights across all systems (OS, Database, SaaS, Network) is maintained.

Required Evidence: Export of users in “Domain Admins,” “Global Admins,” or “Superuser” groups cross-referenced against the HR active employee list.

Pass/Fail Test: If the audit identifies active privileged accounts belonging to terminated employees or unrecognised service accounts, mark as Non-Compliant.

3. Multi-Factor Authentication (MFA) Enforcement Validated

Verification Criteria: All privileged access sessions are protected by robust multi-factor authentication, regardless of whether access is local or remote.

Required Evidence: MFA configuration screenshots for administrative portals (e.g., Azure AD, AWS Console, Google Workspace Admin).

Pass/Fail Test: If any administrative account can log in using only a username and password, mark as Non-Compliant.

4. Separate Administrative Account Usage Verified

Verification Criteria: Personnel with privileged rights use separate, dedicated accounts for administrative tasks, distinct from their standard user accounts used for email and web browsing.

Required Evidence: Sample of admin users showing two distinct UPNs (e.g., john.doe@org.com and admin.john.doe@org.com).

Pass/Fail Test: If administrators perform daily non-privileged tasks (email, document editing) using their privileged account, mark as Non-Compliant.

5. Privileged Access Review Cycle Records Present

Verification Criteria: Management performs a formal review of privileged access rights at high frequency (at least every 90 days) to ensure continued necessity.

Required Evidence: Signed Access Review reports or Jira/ServiceNow tickets showing the review and subsequent revocation of unnecessary rights.

Pass/Fail Test: If the last formal review of privileged users occurred more than 6 months ago, mark as Non-Compliant.

6. Just-In-Time (JIT) Access Implementation Validated

Verification Criteria: For high-risk systems, privileged access is granted on a temporary “Just-In-Time” basis rather than being permanently assigned (Standing Access).

Required Evidence: PIM (Privileged Identity Management) logs or PAM tool reports showing time-bound elevation requests and approvals.

Pass/Fail Test: If all administrators have permanent, 24/7 standing privileged rights to production environments without a JIT mechanism, mark as Non-Compliant.

7. Privileged Session Logging and Monitoring Confirmed

Verification Criteria: All activities performed using privileged access are logged, and alerts are configured for high-risk commands or unauthorised changes.

Required Evidence: SIEM or Audit Log exports showing “Administrative Action” logs and corresponding alert configuration for “Account Added to Admin Group.”

Pass/Fail Test: If privileged actions (e.g., changing firewall rules or deleting backups) are not captured in an immutable audit log, mark as Non-Compliant.

8. Default Password Neutralisation Verified

Verification Criteria: Default administrative passwords for all hardware, software, and appliances are changed immediately upon installation.

Required Evidence: Hardening guides or configuration checklists confirming the change of “admin/password” or “root” defaults.

Pass/Fail Test: If any network appliance or server is found to be accessible via factory-default credentials, mark as Non-Compliant.

9. Shared Account Usage Restrictions Confirmed

Verification Criteria: The use of generic shared administrative accounts (e.g., “Administrator,” “root,” “support”) is prohibited or restricted to emergency “Break Glass” scenarios.

Required Evidence: PAM vault logs showing check-out/check-in of emergency credentials with unique user attribution.

Pass/Fail Test: If multiple individuals share a single administrative password without a system to attribute actions to a specific person, mark as Non-Compliant.

10. Competency and Vetting for Privileged Users Verified

Verification Criteria: Individuals granted privileged access have undergone enhanced background screening and possess the technical competency to manage the systems.

Required Evidence: HR screening records cross-referenced against the privileged user list and relevant technical certifications.

Pass/Fail Test: If unvetted contractors or untrained personnel are found with “Superuser” access to the production environment, mark as Non-Compliant.

About the author