ISO 27001A.8 — Privileged access rights
A.8.2
Privileged access rights
ISO 27001 · ISO/IEC 27001:2022 · Last verified July 2026
Objective
Restrict and manage the allocation and use of privileged access rights according to the need-to-know and least-privilege principles.
Points of focus
- Privileged roles inventoried
- Just-in-time or tightly time-bound elevation
- MFA on privileged paths
- Periodic privileged access review
Implementation notes
Inventory every standing privileged role across cloud, IdP, CI/CD, and datastores. Prefer JIT elevation with MFA and ticket linkage. Separate human admin from deploy automation identities. Review privileged grants monthly or quarterly depending on risk. Align with A.5.15/A.5.18 and SOC 2 CC6.3.
Audit tip: Pick one production break-glass event and walk the ticket: who elevated, why, when revoked.
Evidence auditors typically request:
- Privileged role inventory (cloud IAM, IdP, DB)
- JIT / PAM elevation logs
- MFA enforcement screenshots for admin consoles
- Privileged access review samples
Common gaps
- Standing admin for convenience
- Shared root credentials
- No review of service accounts with admin scopes
Cross-Framework Mapping
| Framework | Requirement | Implementation note |
|---|---|---|
| ISO 27001 | A.8.2 | This control |
| SOC 2 | CC6.1, CC6.3 | Related Trust Services Criteria themes — map in your crosswalk; not identical requirements. |
| GDPR | Article 32 | Related GDPR articles for personal-data security or processor themes — not a compliance claim. |
| HIPAA | 164.308(a)(3) | Related HIPAA Security Rule citations when PHI is in scope — SoA does not replace BAAs. |
Primary sources
- ISO/IEC 27001:2022 Annex A: ISO/IEC 27001:2022 Annex A (A.8.2)
Frequently Asked Questions
If they can change production or read secrets, treat them as privileged — with ownership, logging, and review.
Necessary but not sufficient. Reduce standing use of root; prefer federated admin roles with logging.
Privileged access often needs more frequent review than standard workforce access — monthly is common for high-risk SaaS.