ISO 27001:2022
Technological controls – ISO 27001:2022

ISO 27001:2022 8.18: Use of privileged utility programs

Utility programs able to override system and application controls are to have their use limited and tightly controlled. Purpose (stated in ISO/IEC 27002:2022): ensures utility programs do not harm system and application security controls. As an Annex A reference control, it is compared with the controls determined in risk treatment (6.1.3 c) and recorded in the Statement of Applicability as included or excluded, with the justification and implementation status (6.1.3 d); implementation guidance is ISO/IEC 27002:2022 8.18.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 50 controls across 23 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

FedRAMP High · 6 controls

  • AC-6(10) Prohibit Non-Privileged Users from Executing Privileged Functions
  • AU-9 Protection of Audit Information
  • AU-9(4) Access by Subset of Privileged Users
  • CM-7 Least Functionality
  • MA-3 Maintenance Tools (MA-3)
  • MA-3(1) Maintenance Tools | Inspect Tools (MA-3(1))

FedRAMP Moderate · 6 controls

  • AC-6(10) Prohibit Non-Privileged Users from Executing Privileged Functions
  • AU-9 Protection of Audit Information
  • AU-9(4) Access by Subset of Privileged Users
  • CM-7 Least Functionality
  • MA-3 Maintenance Tools (MA-3)
  • MA-3(1) Maintenance Tools | Inspect Tools (MA-3(1))

NIST SP 800-53 Rev 5 · 5 controls

SOC 2 · 5 controls

  • SOC2-CC5.2 CC5.2 General controls over technology (COSO principle 11)
  • SOC2-CC6.1 CC6.1 Logical access security over protected information assets
  • SOC2-CC6.3 CC6.3 Role-based access, least privilege and segregation of duties
  • SOC2-CC6.8 CC6.8 Preventing and detecting unauthorised or malicious software
  • SOC2-CC8.1 CC8.1 Managing changes to procedures, software, data and infrastructure

Azure Security Benchmark · 3 controls

  • ASBv3-AM-5 Use only approved applications in virtual machine
  • ASBv3-PA-6 Use privileged access workstations
  • ASBv3-PA-7 Follow just enough administration (least privilege) principle

ACSC Essential Eight · 2 controls

  • E8-ADMIN-ML1 Restrict Administrative Privileges (ML1)
  • E8-APP-ML1 Application Control (ML1)

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 2 controls

  • ANSSI-HYG-27 Prohibit Internet Access from Administration Workstations and Servers
  • ANSSI-HYG-29 Limit Administration Rights on Workstations to Operational Need

ASD Strategies to Mitigate Cyber Security Incidents · 2 controls

  • ASD37-01 Application control (Essential)
  • ASD37-18 Restrict administrative privileges (Essential)

CIS Controls v8 · 2 controls

  • CIS-2.5 Allowlist Authorized Software
  • CIS-5.4 Restrict Administrator Privileges to Dedicated Administrator Accounts

CMMC 2.0 · 2 controls

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 2 controls

NIST SP 800-171 Rev 3 · 2 controls

AWS Well-Architected Security Pillar · 1 control

  • SEC06-BP03 Reduce manual management and interactive access

Australia Consumer Data Right - Banking (CDR) · 1 control

  • AUCDR-IS-5 Limit, prevent, detect and remove malware

C5 (Germany) · 1 control

ISO 27001:2013 · 1 control

  • A.9.4.4 Use of privileged utility programs

ISO 27002:2022 · 1 control

  • 8.18 Use of privileged utility programs

ISO 27701:2019 · 1 control

  • 6.6.4 System and application access control

NIST Cybersecurity Framework 2.0 · 1 control

NIST SP 800-161 Rev 1 · 1 control

NIST SP 800-172 · 1 control

  • 3.13.2e Introduce Unpredictability into System Operations

PCI DSS 4.0 · 1 control

  • 9.4.4 9.4.4 Management approval for media leaving facility

UK Cyber Essentials · 1 control

  • CE-AC.5 Separate Admin Accounts for Administrative Activities

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Technological controls – ISO 27001:2022

You are reading one control. How much of ISO 27001:2022 have you already done?

ISO 27001:2022 8.18 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27001:2022 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 79 of 93 ISO 27001:2022 controls already carry evidence.

If you hold NIST SP 800-53 Rev 584.9% covered · 14 gapsIf you hold ISO 27001:201383.9% covered · 15 gapsIf you hold FedRAMP Moderate80.6% covered · 18 gapsIf you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.174.2% covered · 24 gapsIf you hold C5 (Germany)69.9% covered · 28 gapsIf you hold NIST Cybersecurity Framework 2.063.4% covered · 34 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 170 were rejected on the NIST SP 800-53 Rev 5 pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 50 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll ISO 27001:2022 controls