All 93 controls · Technological controls
Control 8.18
Use of privileged utility programs
What ISO/IEC 27002:2022 control 8.18 asks for, in our own words, with the five published attribute values, the evidence an auditor asks for and the gaps commonly found. ISO/IEC 27028 is the guidance that explains how to use these values.
What the control asks
Utility programs able to override system and application controls are to have their use limited and tightly controlled. Purpose: prevent utility programs from undermining system and application security controls. Guidance: consider limiting such utilities to the smallest practical number of trusted, authorized users (8.2); applying identification, authentication and authorization to their use, including uniquely identifying each person using them; defining and documenting authorization levels for them; requiring authorization for one-off use; withholding them from application users on systems that depend on separated duties; removing or disabling all unneeded utilities; separating utilities logically from application software at a minimum, and where practical keeping their network traffic apart from application traffic; making them available only for limited periods, such as the duration of an authorized change; and logging every use. Other information: most systems include utilities that can bypass controls, such as diagnostic, patching, anti-virus, defragmentation, debugging, backup and network tools.
Purpose in the standard’s terms, in our words: Ensures utility programs do not harm system and application security controls.
Attribute values in one line: Preventive; Confidentiality, Integrity, Availability; Protect; System and network security, Secure configuration, Application security; Protection.
The five attribute values
These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.
| Control type | Preventive |
|---|---|
| Information security properties | ConfidentialityIntegrityAvailability |
| Cybersecurity concepts | Protect |
| Operational capabilities | System and network securitySecure configurationApplication security |
| Security domains | Protection |
Evidence an auditor asks for
The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.
- An inventory of utility programs capable of overriding controls on each platform, with those not needed removed or disabled
- A list of authorized users and documented authorization levels for each utility
- Approvals for ad hoc use and time-limited availability, for example tied to change tickets
- Logs of all utility program use with unique user identification
- Configuration showing utilities segregated from application software and not accessible to users bound by segregation of duties
Where audits commonly find gaps
- Debuggers and database tools remain installed on production servers
- Utility use is not logged or not attributable to individuals
- Business users with segregation of duties constraints can run administrative tools
- Utilities are permanently available instead of enabled only for approved changes
What ISO/IEC 27028 changes for this control
It carries a single control type, preventive, which sets what the evidence has to prove. It contributes no detect function, so a control set built from this row alone would not show detection. It crosses 3 operational capabilities, so two teams share the work and the owner column matters. Its earlier numbering (09.4.4) is kept in the register so an older audit file can still be traced.
The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.
Controls that share its values
Source for this page
- ISO/IEC 27002:2022, the control catalogue and Table A.1. The reference record of the 93 controls, their five attribute values, purpose, evidence and gaps. The published standard is at https://www.iso.org/standard/75652.html.
- ISO/IEC 27028, official record. Stage 60.00 under publication, edition 1, committee, abstract and the dated lifecycle. Retrieved 20 October 2026.
Retrieved 2026-10-20. The requirement above is our statement of the clause in our own words; the official text is linked so you can check it.
The attribute kit, USD 799 one off. The 109-row register with all five values, the evidence list, a dated plan and the extension worksheet, as PDF, CSV and XLSX.