IAM-016 Dedicated Administration Systems
Description
Administrative access to production systems is exercised only from systems designated for administration, which are recorded in an inventory with an owner and the scope of administration each covers. A designated system runs no application software and no general-purpose workload outside that scope, including the systems used to administer the implementation of the security policy, and is logically separated from the systems used for other work. Access to a designated system is authenticated and its session encrypted. An administration account is used only to reach a designated system, and an administrative action attempted from a system outside the inventory is blocked at the enforcement point or detected and recorded.
Rationale
The account is not the attack surface; the machine the account is used from is. A privileged credential entered on a workstation that also reads mail and runs a browser is one keystroke logger away from being somebody else's credential, which is why the requirement is stated about the system rather than about the account. Without a recorded scope of administration the inventory cannot be tested at all: a designated system with no stated purpose cannot be shown to serve only that purpose. Boundary with IAM-007: that control holds the account, who holds it, on what justification, for how long, with what logging and session recording, and the rule that administration operations run on accounts used for that alone. This control holds the machine the account is used from and the rule that the account reaches nothing else. IAM-011 holds the approved path into the estate and the multi-factor requirement on the session; a designated system sits at the near end of that path and is not itself a path. INF-004 holds the separation of the administrative network from production, development and test, which is the network these systems sit on. INF-017 holds the baseline every managed endpoint meets; a designated administration system is a stricter class inside it, marked out by the single-purpose rule and the recorded scope.
Applicability (9 profiles)
Administrative access to the deployer's own production estate is its own duty, whoever built the AI system running on it. The administration of the provider's service reaches the deployer as a tenant administration console, which is a designated system like any other.
Administrative access to the deployer's own production estate is its own duty, whoever built the AI system running on it. The administration of the provider's service reaches the deployer as a tenant administration console, which is a designated system like any other.
Annex point 11.4 of Implementing Regulation (EU) 2024/2690 is the anchor: system administration systems used for administration purposes and nothing else, logically separated from application software not used for administration, with access protected by authentication and encryption. Annex point 11.3.2(d), administration accounts used only to connect to administration systems, and point 6.7.2(e), systems used to administer the security policy implementation not used for anything else, both depend on those systems existing as a class and are stated on this control rather than on IAM-007.
Framework Mappings (5)
| NIS2-CIR-11.3 | Privileged Accounts and System Administration Accounts | partial |
| NIS2-CIR-11.4 | Administration Systems | full |
| NIS2-CIR-6.7 | Network Security | partial |
| NIS2-CIR-6.8 | Network Segmentation | informative |
| SC-2 | Separation of System and User Functionality | informative |
Evidence (2)
Configuration of the administrative access path, showing the inventory of designated administration systems with owner and scope, the enforcement that admits only those systems and the baseline applied to them.
Example: Conditional access policy PAW-ADMIN-PROD export and admin-workstation inventory, both dated 12 June 2026.
Test: Verify: (1) an inventory of designated administration systems exists and each entry carries an owner and the scope of administration it covers, (2) the enforcement point for administrative access admits only devices in that inventory, read from the enforcing system rather than from a design document, (3) the baseline applied to those systems excludes application software and general-purpose workloads outside the stated scope, and the systems used to administer the security tooling are inside the designated set rather than beside it, (4) the designated systems are logically separated from the systems used for other work, (5) sessions to a designated system require authentication and are encrypted, with the setting read from the system.
Export of the administrative sessions and actions for the period with the source device of each, reconciled against the designated administration system inventory.
Example: admin-session-source-2026-Q2.csv, generated 1 July 2026, covering 1 412 administrative sessions.
Test: Verify: (1) every administrative session in the export resolves to a device in the inventory on the date of the session, (2) no administration account in the export authenticated to a destination outside the designated set, (3) an administrative action attempted from a device outside the inventory appears with the outcome the enforcement point applied, or a test producing that result is recorded with its date, (4) a device removed from the inventory in the period carries no administrative session after the date it left, (5) the session count reconciles to the privileged action log, so an administrative route that bypasses the enforcement point is visible as a session with no source device.
Questions (3)
Are the systems from which administrative access to production is exercised recorded in an inventory?
Answer against the machines, not the accounts. A list of privileged users is the privileged access control. A convention that administrators use a particular laptop, with nothing recording which laptops those are, is a no.
Which of the following apply to a designated administration system?
Options run from the cheapest to hold to the most demanding. The scope is what makes single-purpose testable: without it, nothing says which software counts as outside the purpose. The last item is the one most often overlooked, because a security administration console tends to be treated as a security tool rather than as an administration system.
How is administrative access attempted from a system outside the designated set handled?
Options run from strongest to weakest. Answer on what the enforcement point actually did the last time it happened, or on the result of a test if it has not happened. A policy that forbids it with nothing enforcing or watching is the third option.