ISO 27001 Control 8.18: Use of privileged utility programs

Most organizations invest heavily in application-layer access controls while leaving an entire class of tools completely unmanaged beneath them. A single privileged utility program left on an endpoint after a troubleshooting session can bypass every access control in the stack. Disk editors, packet sniffers, database consoles, and registry tools operate below the application security layer, giving anyone with access the ability to exfiltrate data, tamper with configurations, or achieve privilege escalation without triggering a single application-level alert.

What 8.18 requires

ISO 27001 8.18 requires organizations to strictly control and restrict the use of utility programs capable of overriding system and application controls, limiting their availability to authorized personnel only. The control targets a specific category of software that most security programs overlook: tools designed to interact directly with system-level resources, bypassing the protections that application-layer security depends on.

The official control objective states that organizations must “strictly control and restrict the use of utility programs that are capable of overriding system and application controls, limiting their availability to authorized personnel only.”

Meeting this requirement involves several operational components:

• Identification and inventory: Organizations must identify and maintain a current register of all utility programs capable of overriding system and application controls. This includes tools like packet analyzers (Wireshark), database management consoles, disk editors, registry editors, and scripting environments with elevated execution capabilities.
• Access restriction: Access to these tools must be limited to authorized personnel who have a documented business justification. Not every system administrator needs access to every privileged utility.
• Segregation of duties: The person requesting access to a privileged utility cannot be the same person who approves it. This separation prevents self-authorization and forces a second set of eyes on every access decision.
• Preference for standard tooling: Organizations should default to standard, non-privileged tools for routine tasks. Privileged utilities are a last resort when no alternative exists.
• Logging and review: All usage of privileged utility programs must be logged, and those logs must be reviewed periodically to detect anomalies, unauthorized use, or access that has outlived its business need.

The critical insight here is positional. These programs exist below the application security layer, which means they bypass every control built on top of it. Firewalls, role-based access controls, and application audit logs are all irrelevant when someone uses a disk editor to read raw data blocks or a packet sniffer to capture credentials in transit.

Why 8.18 matters

Most security teams focus detection and monitoring at the application layer, where authentication events, authorization checks, and audit logs provide a rich signal. Privileged utility programs operate beneath that layer entirely. An attacker who gains access to a legitimate administrator account doesn’t need to exploit a vulnerability or deploy malware. They can use tools already installed on the system to accomplish their objectives.

A packet sniffer running on a server segment can capture credentials and session tokens in transit. None of these actions generate the kind of application-level alerts that Security Operations Centers (SOCs) are tuned to detect, because the tools themselves are trusted by the operating system and the network.

A compromised admin account with access to a database management console can export entire tables of customer data, and the Verizon 2025 Data Breach Investigations Report confirms that 22% of breaches begin exactly this way, with credential abuse opening the door to tools already present on systems.

The risk class spans both integrity and confidentiality. Organizations operating under a principle of least privilege model still face exposure if privileged utilities aren’t governed separately from standard access rights. Privileged utilities can modify system configurations (integrity), extract sensitive data (confidentiality), and in many cases do both without leaving evidence in application-layer logs. Without 8.18 controls, organizations are flying blind in the exact layer where the most damage occurs.

What attackers exploit

• Utility programs left on workstations or servers after troubleshooting sessions, available to anyone with local access
• Standing administrative privileges instead of Just-in-Time (JIT) elevation, giving permanent access to tools that should require per-use approval
• No approval workflow, allowing privileged utilities to be used as “business as usual” rather than controlled exceptions
• Missing or incomplete audit logging of utility execution, creating blind spots where usage goes undetected
• Shared service accounts for running privileged utilities, making it impossible to attribute actions to individual users
• No periodic review of who retains access to privileged tools, allowing permissions to accumulate long after the original business need expires

How to implement 8.18

For your organization (first-party)

Implementing 8.18 effectively requires a combination of policy, process, and technical enforcement. Policy alone won’t prevent unauthorized utility use, and technical controls without process create friction that drives workarounds.

1. Inventory all utility programs. Catalog every tool on your endpoints and servers that can interact with system-level resources. This includes Wireshark, PowerShell ISE, SQL Server Management Studio, disk editors, registry editors, and any scripting environment capable of elevated execution. Don’t limit the inventory to what IT formally deployed; scan for tools users have installed themselves.
2. Classify each utility as privileged or standard based on whether it can override system or application controls. A text editor is standard. A registry editor that can modify security policies is privileged. Classification drives every downstream control decision.
3. Establish an approval workflow. Every request to use a privileged utility should follow a structured path: request with business justification, manager review, security team approval, and time-limited access grant. The approval chain must enforce segregation of duties so that no individual can both request and approve their own access.
4. Implement application allowlisting to block execution of unapproved utilities at the endpoint level. Tools like Microsoft AppLocker, CrowdStrike Falcon Device Control, or Carbon Black App Control can prevent unauthorized utilities from running regardless of the user’s local permissions.
5. Deploy Privileged Access Management (PAM) tooling for JIT elevation. Solutions in the CyberArk, BeyondTrust, or Delinea category allow users to request temporary elevated access that automatically expires, eliminating the need for standing admin privileges.
6. Enable comprehensive audit logging that captures who ran which tool, what commands they executed, and when. Integrate these logs into your Security Information and Event Management (SIEM) platform so they’re correlated with other security events.
7. Schedule quarterly access reviews. Review who has access to each privileged utility and revoke access when the business need has expired. Recertification should require the current manager and security team to confirm ongoing need.
8. Remove utilities from endpoints once the approved task is complete. Privileged tools shouldn’t persist on systems between uses. Automate cleanup where possible through endpoint management policies.

Common mistakes:

• Maintaining a utility inventory in a spreadsheet but not enforcing restrictions technically, leaving the inventory as documentation without teeth
• Granting permanent admin rights to avoid the overhead of JIT access requests, which is the most common way organizations undermine 8.18 in practice. With the Ponemon Institute reporting that insider-related incidents cost organizations an average of $16.2 million annually, the convenience of standing privileges carries a measurable price tag when insider threats materialize
• Logging utility access but never reviewing the logs, creating a false sense of compliance
• Allowing the same person to request and approve their own access to privileged utilities
• Forgetting cloud-based admin consoles (AWS CloudShell, Azure Cloud Shell, GCP Console) in the utility inventory

Effective implementation typically involves coordination across identity and access management providers (Okta, Microsoft Entra ID), PAM solutions, SIEM platforms, and endpoint management tools. The goal is layered enforcement so that no single control failure leaves privileged utilities exposed.

For your vendors (third-party assessment)

When assessing vendors against 8.18, the goal is to determine whether they’ve moved beyond policy statements into verifiable operational controls.

Questionnaire questions to include:

• “Do you maintain an inventory of privileged utility programs across your environment?”
• “What approval process governs access to privileged utilities, and does it enforce segregation of duties?”
• “How do you log and review usage of privileged utility programs?”
• “What is your process for revoking access when it’s no longer needed?”

Evidence to request:

• Current privileged utility program inventory with classification, ownership, and authorized user lists
• Access request and approval records from the past quarter showing the full workflow chain
• Audit logs demonstrating utility execution tracking with user attribution
• Quarterly access review reports showing recertification or revocation decisions

Red flags during assessment:

• “All administrators have access to all tools” with no granular restriction
• No documented approval workflow for privileged utility access
• Shared administrative accounts used to run privileged utilities
• No audit trail for utility program execution

Verification approach: Request a sample audit log showing actual utility usage events. Ask for PAM platform screenshots demonstrating JIT access workflows. Cross-reference against SOC 2 Type II report evidence for logical access controls as part of your broader third-party risk management program. A vendor that can produce these artifacts quickly likely has mature controls; one that needs weeks to gather them probably doesn’t.

Audit evidence for 8.18

Preparing for an ISO 27001 audit against 8.18 requires documented evidence across seven categories. Auditors look for consistency between what the policy states and what operational records demonstrate.

Cross-framework mapping

Control 8.18 aligns with several controls across major compliance frameworks, making implementation efforts reusable across multiple audit and regulatory requirements.

The full alignment with NIST 800-53 AC-03 and AC-06 means organizations already mapping to the NIST framework will find significant overlap, reducing the incremental effort required for ISO 27001 certification.

Related ISO 27001 controls

Control 8.18 doesn’t operate in isolation. Several other ISO 27001 controls intersect with privileged utility management, and auditors will expect to see consistent implementation across them.

Frequently asked questions

What is ISO 27001 8.18?

ISO 27001 8.18 is the control that requires organizations to strictly control and restrict the use of utility programs capable of overriding system and application controls. It covers the identification, authorization, logging, and periodic review of tools like disk editors, packet sniffers, database consoles, and registry editors that operate below application-layer security. The goal is to ensure these powerful tools are only available to authorized personnel with a documented business justification.

What happens if 8.18 is not implemented?

Without 8.18 controls, privileged utility programs become an unmonitored attack path that bypasses application-layer security entirely. Attackers with valid credentials can use these tools to exfiltrate data, modify configurations, and escalate privileges without generating alerts. Organizations also face nonconformity findings during ISO 27001 audits, potential regulatory penalties, and significantly increased exposure to insider threats.

How do you audit 8.18?

Auditing 8.18 starts with verifying that a privileged utility program inventory exists and is actively maintained. Auditors then review access request records for segregation of duties, examine audit logs for completeness, and check quarterly access review reports for evidence of recertification or revocation. The key test is consistency between policy and practice, meaning what the policy says should match what the logs and approval records demonstrate.

How UpGuard helps

Privileged utility oversight requires visibility into workforce behavior that most security tools don’t provide.

• User Risk: Discovers hidden workforce risks including unauthorized use of privileged tools, Shadow IT, and compromised credentials. Delivers real-time coaching at the exact moment a risky behavior occurs, building measurable, secure habits across your organization.

Start a free trial to experience the UpGuard cybersecurity platform.