What evidence does ISO 27001:2022 8.18 need?

Statement of Applicability entry for control A.8.18, showing inclusion or justified exclusion, implementation status and the risks it treats. An inventory of utility programs capable of overriding controls on each platform, with those not needed removed or disabled. A list of authorized users and documented authorization levels for each utility

8.18 of ISO 27001:2022, stated here in our words and cited to that clause.

Does it map to the other framework?

Yes, to 1 criteria in the other framework, each with a confidence and a reason. A link is a topical overlap, not a legal equivalence.

ISO 27001:2022 8.18 evidence: Use of privileged utility

ISO 27001:2022 8.18: Use of privileged utility programs

ISO 27001:2022 8.18 covers Use of privileged utility programs. The held text names 5 evidence records for it, the first being Statement of Applicability entry for control A.8.18, showing inclusion or justified exclusion, implementation status and the risks it.... The common gap an assessor flags is Debuggers and database tools remain installed on production servers.

Utility programs able to override system and application controls are to have their use limited and tightly controlled. Purpose (stated in ISO/IEC 27002:2022): ensures utility programs do not harm system and application security controls. As an Annex A reference control, it is compared with the controls determined in risk treatment (6.1.3 c) and recorded in the Statement of Applicability as included or excluded, with the justification and implementation status (6.1.3 d); implementation guidance is ISO/IEC 27002:2022 8.18.

What evidence supports 8.18?

Annex A technological controlStatement of Applicability entry for control A.8.18, showing inclusion or justified exclusion, implementation status and the risks it treats
Annex A technological controlAn inventory of utility programs capable of overriding controls on each platform, with those not needed removed or disabled
Annex A technological controlA list of authorized users and documented authorization levels for each utility
Annex A technological controlApprovals for ad hoc use and time-limited availability, for example tied to change tickets
Annex A technological controlLogs of all utility program use with unique user identification

Where this requirement comes from

This is our own statement of ISO 27001:2022 8.18, read from the copy we hold (licensed complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.

Common gaps an assessor flags

Debuggers and database tools remain installed on production servers
Utility use is not logged or not attributable to individuals
Business users with segregation of duties constraints can run administrative tools
Utilities are permanently available instead of enabled only for approved changes

How it maps to SOC 2

CC6.8 high Restricting privileged utility programs prevents control overriding software.

A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.