Frameworks / ISO 27001:2022 / 8.2 ISO 27001:2022
Technological controls – ISO 27001:2022
ISO 27001:2022 8.2: Privileged access rights The granting and use of privileged access rights are to be limited and managed. Purpose (stated in ISO/IEC 27002:2022): limits privileged access to authorized people, software components and services. As an Annex A reference control, it is compared with the controls determined in risk treatment (6.1.3 c) and recorded in the Statement of Applicability as included or excluded, with the justification and implementation status (6.1.3 d); implementation guidance is ISO/IEC 27002:2022 8.2.
Maintained by Gerard Blokdyk · Verified against the published standard 18 August 2026 · Control text last updated 25 September 2026 What else in your programme already covers this This control maps to 133 controls across 30 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
10.2.1.5 10.2.1.5 Logs capture changes to identification and authentication credentials 10.6.3 10.6.3 Time sync configuration and time data protected 2.2.2 2.2.2 Vendor default accounts managed 2.2.7 2.2.7 Non-console administrative access encrypted 3.5.1.2 3.5.1.2 Disk or partition encryption only on removable media 3.6.1.2 3.6.1.2 Permitted storage forms for secret and private keys 3.6.1.3 3.6.1.3 Cleartext key component access limited to minimum custodians 3.7.6 3.7.6 Split knowledge and dual control for manual key operations 7.2.2 7.2.2 User access assigned by job function and least privilege 7.3.2 7.3.2 Access control system enforces role-based permissions 8.2.2 8.2.2 Shared and generic IDs only by exception 8.2.3 8.2.3 Service provider unique factors per customer 8.2.4 8.2.4 User ID lifecycle changes authorized 8.4.1 8.4.1 MFA for non-console administrative CDE access 9.2.3 9.2.3 Physical protection of network hardware and lines 9.2.4 9.2.4 Locking of consoles in sensitive areas 9.4.1 9.4.1 Physical security of all media 3.6.1 3.6.1 Procedures protect keys against disclosure and misuse 6.5.4 6.5.4 Separate roles between production and pre-production 7.2.4 7.2.4 User accounts and privileges reviewed every six months 7.2.5 7.2.5 Application and system accounts least privilege 7.2.6 7.2.6 Query access to stored cardholder data restricted 7.3.1 7.3.1 Need-to-know access control system covers all components 8.6.1 8.6.1 Interactive use of system accounts controlled AC-2 Account Management AC-2(1) Automated System Account Management AC-2(7) Privileged User Accounts AC-6 Least Privilege AC-6(1) Authorize Access to Security Functions AC-6(10) Prohibit Non-Privileged Users from Executing Privileged Functions AC-6(2) Non-Privileged Access for Nonsecurity Functions AC-6(5) Privileged Accounts AC-6(7) Review of User Privileges AU-9(4) Access by Subset of Privileged Users CM-5 Access Restrictions for Change CM-5(5) Access Restrictions for Change | Privilege Limitation for Production and Operation (CM-5(5)) RA-5(5) Privileged Access SC-2 Separation of System and User Functionality AC-2 Account Management AC-2(1) Automated System Account Management AC-2(7) Privileged User Accounts AC-6 Least Privilege AC-6(1) Authorize Access to Security Functions AC-6(10) Prohibit Non-Privileged Users from Executing Privileged Functions AC-6(2) Non-Privileged Access for Nonsecurity Functions AC-6(5) Privileged Accounts AC-6(7) Review of User Privileges AU-9(4) Access by Subset of Privileged Users CM-5 Access Restrictions for Change CM-5(5) Access Restrictions for Change | Privilege Limitation for Production and Operation (CM-5(5)) RA-5(5) Privileged Access SC-2 Separation of System and User Functionality ASBv3-AM-4 Limit access to asset management ASBv3-IM-2 Protect identity and authentication systems ASBv3-PA-4 Review and reconcile user access regularly ASBv3-PA-5 Set up emergency access ASBv3-PA-7 Follow just enough administration (least privilege) principle PA-1 Separate and limit highly privileged/administrative users PA-2 Avoid standing access for user accounts and permissions PA-3 Manage lifecycle of identities and entitlements NIST800-AC-3 AC-3 Access Enforcement NIST800-AC-5 AC-5 Separation of Duties NIST800-AC-6 AC-6 Least Privilege NIST800-IA-2 IA-2 Identification and Authentication (Organizational Users) NIST800-SC-2 SC-2 Separation of System and User Functionality NIST800-SC-49 SC-49 Hardware-enforced Separation and Policy Enforcement SP800-53-IA Identification and Authentication Family ANSSI-HYG-05 Maintain an Exhaustive Inventory of Privileged Accounts ANSSI-HYG-08 Identify Each Person by Name and Separate User and Administrator Roles ANSSI-HYG-13 Prefer Strong Authentication Where Possible ANSSI-HYG-27 Prohibit Internet Access from Administration Workstations and Servers ANSSI-HYG-29 Limit Administration Rights on Workstations to Operational Need CIS-12.5 Centralize Network Authentication, Authorization, and Auditing (AAA) CIS-12.8 Establish and Maintain Dedicated Computing Resources for All Administrative Work CIS-4.7 Manage Default Accounts on Enterprise Assets and Software CIS-5.4 Restrict Administrator Privileges to Dedicated Administrator Accounts CIS-6.5 Require MFA for Administrative Access SOC2-CC5.1 CC5.1 Selecting control activities that mitigate risk (COSO principle 10) SOC2-CC5.2 CC5.2 General controls over technology (COSO principle 11) SOC2-CC6.1 CC6.1 Logical access security over protected information assets SOC2-CC6.2 CC6.2 Registering and authorising users before issuing credentials SOC2-CC6.3 CC6.3 Role-based access, least privilege and segregation of duties CE-AC.4 Privileged Account Approval and Tracking CE-AC.5 Separate Admin Accounts for Administrative Activities CE-AC.6 Periodic Review of Privileged Access CE-AC.7 MFA for Administrative Accounts E8-ADMIN-ML1 Restrict Administrative Privileges (ML1) E8-ADMIN-ML2 Restrict Administrative Privileges (ML2) E8-ADMIN-ML3 Restrict Administrative Privileges (ML3) NIST-CSF-PR.AA-01 Identities and credentials for authorized users, services, and hardware are managed by the organization NIST-CSF-PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties NIST-CSF-PR.PS-05 Installation and execution of unauthorized software are prevented ASD37-18 Restrict administrative privileges (Essential) ASD37-21 Disable local administrator accounts (Excellent) Art.21.2.g Basic cyber hygiene practices and cybersecurity training Art.21.2.i Human resources security, access control policies and asset management 3.1.1e Dual Authorization for Sensitive System Operations 3.5.3e Prohibit Connection of Unknown or Unverified System Components AUCDR-IS-1 Limit risk of unauthorised access to the CDR data environment DSS05.04 DSS05.04 Manage user identity and logical access A.9.2.3 Management of privileged access rights 8.2 Privileged access rights 6.6.2 User access management Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in Technological controls – ISO 27001:2022 You are reading one control. How much of ISO 27001:2022 have you already done? ISO 27001:2022 8.2 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27001:2022 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 79 of 93 ISO 27001:2022 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 170 were rejected on the NIST SP 800-53 Rev 5 pair alone.
Query this from an agent The graph holds this control, the 133 it maps to, and the evidence behind each claim, over MCP and REST.