Safeguard 12.8 Dedicated admin workstations: evidence and audit

What Safeguard 12.8 asks for and why administrators need their own machines

Safeguard 12.8 asks the enterprise to provide dedicated computing resources for all administrative work, meaning any task that needs administrative access. Those resources must be either physically or logically separated from everyday use, segmented from the primary network, and without internet access. The point is that the machine an administrator uses to change firewall rules, manage directories or touch backups should not be the same machine that opens email, browses the web or reads documents. Under CIS Controls v8.1 this is the only Safeguard in Control 12 that sits solely in Implementation Group 3, so it is expected mainly of enterprises with dedicated security staff and sensitive or regulated assets.

The risk is simple to state. A phishing link, a malicious attachment or a compromised browser extension on an administrator's everyday machine can capture session tokens, saved credentials or privileged keys, and an attacker who holds them can reach the network devices and management planes that the rest of Control 12 tries to protect. A separate administrative workstation with no general browsing or email, reachable only from a narrow management segment, breaks that path. Your first decision is scope: list which tasks count as administrative, including cloud consoles, hypervisors, identity administration and network device management, because an unlisted task usually stays on a shared laptop.

The hard part is rarely the hardware. Most organizations find split-use habits, such as an administrator who checks mail or runs a vendor portal from the same session, and shared jump hosts that quietly accumulate general-purpose software. Confirm with the Safeguard's assessment measures how administrative assets will be counted and which configuration attributes count as properly configured, and inventory the assets first, since the Assessment Specification treats Safeguards 1.1 and 4.2 as prerequisites. The CIS Controls Assessment Specification sets out the measures, and your own environment determines how they are met.

Which administrative tasks, systems and people fall under 12.8

Before any workstation is bought or segmented, the organization has to decide what counts as administrative work, which systems those workstations reach and who is allowed to use them. Each decision below changes the size of the environment, the controls needed and the evidence an assessor will ask to see for Safeguard 12.8 Dedicated administrative computing resources.

Administrative tasks versus elevated access

Safeguard 12.8 covers tasks that are administrative or that need administrative access, which is narrower than every task run with elevated rights. Patching a server, changing firewall rules and editing directory group membership belong in scope. Running a privileged reporting query or using a sudo command to read a log may need a decision that is written down and justified. Ask each system owner to list the tasks that require administrative rights and record which ones are excluded and why.

Network segments the workstations reach

The workstations should sit in a segment separated from the primary network, and the scope must name every segment they can reach. Hypervisor management networks, out-of-band management interfaces, backup consoles and the network segments of security tools are common reach points. Confirm each allowed path with a firewall rule set that can be reviewed, for example on OPNsense, where rules match by source, destination, port and protocol and can be logged.

Management planes in the cloud and virtualization

Cloud consoles, identity provider admin portals, hypervisor managers and container orchestration APIs are management planes that often run over the internet. Safeguard 12.8 asks that administrative work avoid internet access, so each management plane needs a documented path, such as a private endpoint or a jump route through the dedicated segment. Ask the team which management planes are reachable from ordinary laptops today, because those are the paths that need to close or move.

Internal administrators

Scope should name every internal person who holds administrative rights on in-scope systems, including members of network, server, identity and security teams. Include break-glass and emergency accounts, because they are often used from unmanaged devices. Pull the membership of privileged groups from the directory and reconcile it against the list of people approved to use the dedicated workstations. Gaps in that comparison become the first findings an assessor raises.

Third-party and vendor administrators

Managed service providers, hardware vendors and software support staff often administer systems remotely, and their access is an administrative path into scope. Decide whether they use the organization's dedicated resources, a vendor-managed separated workstation, or a controlled remote session that is recorded. Contract terms should say which option applies. Each option needs its own evidence, such as the vendor's device configuration and access logs, which the organization must request before the assessment.

Dependencies that set the measurement base

The CIS Controls Assessment Specification lists Safeguards 1.1 and 4.2 as prerequisites for measuring Safeguard 12.8. An accurate enterprise asset inventory decides which administrative workstations and management hosts exist to be counted, and a documented secure configuration process for network infrastructure decides how they are built. Without both, the share of properly configured administrative assets cannot be calculated with confidence. Confirm these inventories exist before setting the scope boundary.

How an assessor tests Safeguard 12.8

This table walks through how an assessor applies the CIS Controls Assessment Specification to Safeguard 12.8, from prerequisites and the Compliance metric to the evidence requested and the findings that most often appear. Read each row as a step in the test, with the right-hand column showing what the organization should have ready before the assessment starts.

Test element	What the assessor checks	Evidence to prepare
Prerequisite: asset inventory	Confirms that the enterprise asset inventory (Safeguard 1.1) is complete enough to identify which hosts are administrative workstations or jump hosts	Asset inventory extract with owner, role tag and network segment for every administrative device
Prerequisite: network configuration	Confirms that network infrastructure has a secure configuration process (Safeguard 4.2) that governs the segments and rules isolating administrative resources	Documented configuration process, current baseline for network devices and change records
Compliance metric	Measures the share of administrative assets that are properly configured as dedicated, segmented and without internet access, against the total set of administrative assets	A ratio built from the inventory, with each administrative asset marked as compliant or exception, and the reason for each exception
Scope of administrative work	Checks that tasks needing administrative rights, including privileged access to network devices, servers and cloud consoles, are actually routed to the dedicated resources	List of administrative task types and the workstation or jump host used for each, reconciled against privileged account records
Network segmentation	Tests whether the path from administrative resources to the primary user network is restricted, and whether that restriction is enforced rather than only documented	Network diagrams showing the administrative segment, firewall rule sets between segments and sample rule exports
Internet egress	Tests whether administrative hosts can reach the internet directly, through proxies or through update channels that were not approved	Firewall rules and egress policy for the administrative segment, plus a sample of blocked and logged outbound attempts
Configuration baseline	Samples administrative hosts and compares settings with the approved baseline, looking for drift and unmanaged software	Baseline documents, configuration management or scan output for sampled hosts, and approved exception records
Common finding: shared use	Administrative devices used for email, web browsing or general office work, which defeats the purpose of separation	Usage policy, user attestation and evidence that no general-purpose applications run on administrative hosts
Common finding: admin hosts with internet access	Administrative workstations that can browse, download or receive updates from public internet sites without a controlled route	Egress rule review showing a documented exception process, or evidence that the rule was corrected before the assessment

How to implement dedicated admin computing in six steps

This sequence moves from knowing which administrative tasks and assets exist to proving that they run on dedicated, separated workstations. Each step produces an artifact that an assessor can trace back to Safeguard 12.8.

Identify administrative tasks and assets
Start by listing every task that needs administrative access, such as changing firewall rules, managing hypervisors, administering identity systems and accessing cloud consoles with elevated roles. Use the detailed asset inventory built under Safeguard 1.1 to mark which devices and accounts perform those tasks, and record who performs each one. The output is a register of administrative tasks mapped to named assets and roles. You know this step is done when the register accounts for every privileged path your team uses, and the owner of each asset has signed off on it.
Define the secure configuration baseline
Under the secure configuration process for network infrastructure described in Safeguard 4.2, write the baseline that each administrative workstation must meet. Cover the operating system build, patch level, endpoint protection, disk encryption, local account restrictions, approved management software and the rules that block general browsing and email. The security team owns the baseline, and the platform team implements it. The output is a versioned, approved baseline document with a named owner and a review date. You know this step is done when a reviewer can check a single workstation against the document without asking questions.
Choose physical or logical separation
Decide whether each administrative function gets a physical workstation, a virtual machine on a separate management host, or a dedicated virtual desktop. Physical separation gives the strongest isolation but adds hardware to buy, track and replace. Logical separation reuses hosts but depends on the hypervisor and its management plane being hardened and monitored. Document the choice per function, the reason for it and the residual risk. The output is a decision record that the CISO or equivalent has approved. You know this step is done when every administrative function in the register has an assigned separation model.
Build segmentation and egress blocking
Place the administrative resources in a management network that is segmented from the primary user network and from servers that hold business data. Configure firewall rules so that only the required management ports reach managed assets, and deny all outbound internet access from the administrative segment, including package repositories unless they run through an approved internal mirror. Platforms such as OPNsense allow rules to be written by source, destination, port and protocol, with aliases for grouped addresses and logging of each rule match for review. Test the rules from the administrative segment by attempting outbound connections and recording the results. The output is a rule set, a diagram reference and test evidence. You know this step is done when outbound tests fail as designed and the rule logs show the expected matches.
Enforce use through access controls
Make the dedicated resources the only route for administrative work. Limit who can sign in to them, require strong multi-factor authentication, and block the use of the same accounts on ordinary workstations. Tie access to the administrator account inventory and the centralized identity service so that joiners, movers and leavers change access in one place. Where a platform supports it, use just-in-time elevation so that privileged sessions are time-bound and logged. The output is an access control list for the administrative segment, a list of accounts permitted to use it and the authentication configuration. You know this step is done when a test administrator account cannot reach a privileged system from a standard workstation.
Measure the compliance share
Calculate the Compliance metric defined for Safeguard 12.8 in the CIS Controls Assessment Specification: the share of administrative assets that are properly configured. Divide the number of administrative assets that pass every baseline check by the total number of administrative assets in the register, then repeat the measurement on a schedule you set and record the results. Investigate each failing asset, fix it or remove its administrative use, and keep the history. The output is a dated measurement report with the numerator, denominator and exception log. You know this step is done when the report can be reproduced by a second person from the same register and scan data.

Choosing between physical separation and logical separation

Safeguard 12.8 accepts either physical or logical separation, so the first decision is which model fits the organization's risk. Physical separation means a dedicated administrative device that is never used for email, browsing or other general work and never joins the primary network. Its direct costs are hardware purchase, replacement on the normal lifecycle and separate patching, and each administrator carries a second machine, which adds a login step and can slow some tasks. An assessor can verify it by matching each administrative device in the asset inventory, which depends on Safeguard 1.1, to a documented role and a network position outside the primary segment. The choice belongs to the organization and must be justified in its own risk assessment and recorded there.

Logical separation keeps one physical device but isolates the administrative session. The common designs are a management VLAN with egress limited to the systems administrators must reach, or a virtual administrative workstation hosted on a separate management network. Costs shift from hardware toward design work, virtualization licensing and ongoing firewall rule maintenance, and the user experience improves because one device serves both roles. The weakness is shared infrastructure: a hypervisor or switch that also carries corporate workloads becomes part of the trust boundary, so the assessment must show the administrative path does not depend on components that general users can affect. The evidence is the rule set itself. As an illustrative example, an OPNsense segment could use aliases for management addresses, pass only the required ports to those aliases, block the remaining outbound traffic and log each rule match for review. Confirm the rule export, logging settings and egress tests against the OPNsense rules documentation.

Whichever model is chosen, test it before an assessor does. Attempt general web access from an administrative device, confirm it cannot reach the internet directly, and check that its traffic reaches only the intended targets. The assessment specification scores the share of properly configured administrative assets with a Compliance metric, so the secure configuration baseline under Safeguard 4.2 must already be defined before measurement starts. Ask any implementation partner for a written scope that itemizes hardware or virtualization work, rule design, testing and evidence packaging, and that separates one-time setup from recurring patching and rule review. The partner prepares the systems and records, and only an independent auditor or assessor issues conclusions. Read the measurement guidance in the CIS Controls Assessment Specification for Safeguard 12.8 before writing the test plan.

Evidence that shows administrative resources are separated

An assessor testing Safeguard 12.8 will want to see that administrative computing resources exist, that they sit apart from the primary network, and that they cannot reach the internet. The six artifacts below work together: the inventory identifies the devices, the diagrams and rule exports prove the separation, and the baseline and reports show it stays in place over time.

Asset inventory tagging administrative devices

The inventory is where the organization proves which machines are administrative resources at all. Each administrative workstation, jump host or management console should carry a tag or field that marks its role, owner and segment. Safeguard 1.1, the detailed enterprise asset inventory, is a prerequisite for measuring 12.8, so an assessor will check that the tagged list matches what is actually on the admin network. Confirm the inventory is reconciled against discovery scans at a set interval and that untagged devices in the admin segment are investigated.

Network diagrams showing the admin segment

Diagrams show the admin segment as a distinct zone with its boundaries, the controlled paths into it and the systems it manages. This matters because Safeguard 12.8 requires separation from the primary network, and a diagram is the fastest way for an assessor to see whether that separation is designed or only assumed. Keep the diagram tied to the current firewall and VLAN configuration, and record the date and owner of each revision so a reviewer can see whether it reflects the live network.

Firewall rule exports with source, destination and port

Rule exports show what traffic the admin segment may send and receive. Each exported rule should name its source, destination, port and protocol, and the rules should default to deny for traffic leaving the admin zone. Open-source firewalls such as OPNsense let teams use aliases for address groups and log each rule match, which gives reviewers evidence that rules are used as written. Export the rule set on a schedule, store it under version control, and review every change against an approved request.

Proof of no internet route

Safeguard 12.8 expects administrative resources to have no internet access, so the organization needs evidence that no path exists, not only a policy saying so. Useful proof includes routing table snapshots, egress rule tests run from an admin host to an external address, and results from scans run from outside the segment. Ask the team to document each test, its expected result and the date it was run, and to repeat the tests after any firewall, routing or cloud network change.

Configuration baseline records

A configuration baseline records how each administrative workstation is built and hardened, including its operating system version, enabled services, local accounts and host firewall settings. Safeguard 4.2, the secure configuration process for network infrastructure, is a prerequisite for 12.8, so the baseline should follow a documented secure configuration process. Assessors will look for the baseline itself, evidence that it was applied to each device, and a record of approved deviations with their justification.

Periodic compliance reports

The CIS Controls Assessment Specification scores Safeguard 12.8 with a Compliance metric: the share of properly configured administrative assets. A periodic report that calculates this share from the inventory and baseline, and lists each non-compliant device with its remediation status, gives the organization a number it can track and an assessor a clear record. Ask the team to define the reporting interval, the owner who signs off on each report and how exceptions are recorded and closed.

What meeting Safeguard 12.8 costs in money and effort

This table breaks down the cost and effort components of separating administrative computing from the primary network, who is paid for each, and whether it is one-time or recurring. Use it to shape a written scope and to compare quotes on like-for-like terms. No figures are given because none were supplied for this safeguard, so ask for them in the quote.

Cost component	Who is paid or who does the work	One-time or recurring	What drives it up or down
Separated admin workstations (physical or virtual)	Hardware vendor or cloud provider, plus internal IT for build and issue	Initial build is one-time; refresh and patching recur	Number of administrators and tool sets; virtualization on existing hosts lowers hardware spend
Network segmentation for admin zone	Internal network team or implementation partner, plus any switch or firewall vendor	One-time design and build; recurring change control	Size of the existing flat network and how many admin paths must be re-routed
Firewall policy engineering	Internal security engineers or implementation partner	Initial rule set one-time; rule reviews recur	Number of allowed flows from admin zone to targets; using aliases for address groups reduces rule count. OPNsense, under BSD-2-Clause, carries no license fee.
Internet egress blocking for admin zone	Network and security engineers	One-time configuration; recurring exception handling	Number of update, vendor and licensing services admins genuinely need; a documented exception list keeps this bounded
Configuration baseline and hardening	Internal platform team, optionally with a hardening specialist	One-time baseline; recurring drift checks	Operating system variety; open-source baselines such as CIS Benchmarks reduce authoring effort
Asset inventory and prerequisite work (1.1 and 4.2)	Internal IT and asset owners	Largely one-time, then recurring upkeep	Maturity of existing inventory; 12.8 measurement depends on it
Evidence upkeep and logs	Internal compliance and security operations	Recurring	Log retention volume and how often the admin population changes
Assessor sampling and walkthroughs	Independent auditor or assessor, fees set by their engagement terms	Recurring with each assessment cycle	Number of admin assets sampled and how cleanly evidence is organized before the assessor arrives

Open-source firewall tooling for admin network segmentation

Safeguard 12.8 expects administrative computing resources to be segmented from the primary network and kept away from the internet. A stateful packet filter is the control that enforces that boundary. OPNsense is an open-source option built on the BSD-2-Clause license, and its firewall rules pass, block or reject traffic according to source, destination, port and protocol. For an admin segment, the practical design is a default-deny stance toward the primary network and the internet, with only the specific flows administrators need allowed through.

Default deny between zones: Start the admin segment with blocking rules toward the general user network and outbound internet, then add narrow pass rules for approved destinations.
Source and destination scoping: Restrict rules to the admin workstation addresses and to the management interfaces they must reach, not to whole subnets.
Protocol and port limits: Permit only the management protocols in use, such as SSH or HTTPS to named targets, and document each permitted port.
Stateful return traffic: Confirm that return traffic for approved sessions is handled as intended, and that unsolicited inbound connections into the admin segment are dropped.
Configuration in version control: Keep exported firewall configuration under change control so each rule change has a reviewer and a date.

Confirm in your own environment that the rules behave as written by testing blocked paths from an admin workstation and from an ordinary user device.

Where organizations fall short on 12.8 and how to close it

Most failures against Safeguard 12.8 come from admin work that still shares a device, network or tool with ordinary business activity. The gaps below are the ones assessors and implementers see most often, and each one is paired with a closing action the organization can verify.

Admins browse and email on the same device

When an administrator uses one laptop for privileged console sessions, web browsing and email, a phishing link or malicious page can reach the same session that holds admin rights. Safeguard 12.8 expects dedicated resources for administrative tasks, so the closing action is to issue a separate administrative workstation or virtual machine for privileged work only. Check that the admin device has no mail client and no general browsing profile.

Undocumented admin tasks

Many organizations cannot list which tasks require administrative access, so the admin segment ends up used for some tasks and bypassed for others. Without a documented list, an assessor cannot determine whether all administrative work runs on dedicated resources. Close the gap by writing down each privileged task, the system it touches and the workstation it must use, then reviewing that list on a fixed schedule.

Egress left open for updates

Administrative resources are often given internet access so patches and tools can download, which removes the isolation the safeguard describes. A dedicated workstation with open egress can still be reached by malware that is already present. Close the gap by routing updates through an internal mirror or a controlled proxy, and confirm with a test that the admin segment cannot reach arbitrary external addresses.

Vendor access bypassing the admin segment

Managed service providers and software vendors sometimes connect straight to production systems through their own remote tools, which skips the dedicated administrative path. The administrative resource requirement then holds only for internal staff. Close the gap by requiring every third-party session to enter through the administrative segment, and by recording vendor access in the same logs used for internal admins.

Stale inventory tags

Safeguard 12.8 measurement depends on knowing which devices are administrative assets, and Safeguard 1.1 provides the inventory that supports it. If tags are not updated when a laptop is reassigned or repurposed, the compliance count becomes unreliable. Close the gap by tying the admin tag to the asset record and reconciling tags against the inventory at a set interval.

No compliance metric

The CIS Controls Assessment Specification measures this safeguard as the share of properly configured administrative assets, so an organization that does not calculate that share has no evidence of its own. Without a metric, gaps stay hidden until an assessor finds them. Close the gap by defining what a properly configured admin asset means in your environment, reporting the share regularly and keeping the report with its source data.

Questions buyers ask about Safeguard 12.8

Can we implement Safeguard 12.8 in-house without an outside partner?

Yes, in most organizations the controlling work can be done by internal staff, because the Safeguard asks you to provide separate computing resources for administrative tasks and keep them off the primary network and off the internet. The harder part is usually the time of people who already run the network and identity systems. Internal teams often need help with hardened build images, network segmentation changes and evidence collection. Ask any partner to separate what they configure from what you own: the organization owns its controls, a partner prepares systems and evidence, and only an independent auditor issues a report.

What work does Safeguard 12.8 require from our team?

The work falls into four areas that your team should plan for:

Inventorying which tasks count as administrative and which accounts and devices perform them.
Building or procuring separate administrative workstations or virtual desktops, with hardened configurations.
Segmenting those resources from the primary network and blocking their internet access, usually through firewall rules and identity controls.
Maintaining a record that shows each administrative asset is configured correctly over time.

Each area needs a named owner, a change process and periodic review.

How long does it take to implement Safeguard 12.8?

The duration depends on scope: the number of administrative roles, the state of your asset inventory and network, how many firewalls and segments are involved, and whether your existing identity and remote access setup can be reused. Ask any provider for a written scope and timeline before work starts. Most engagements of this kind are fixed-scope, so the agreed deliverables and dates should appear in writing. Also confirm whether ongoing monitoring of configuration compliance is included or sold separately.

Does Safeguard 12.8 apply to every organization or only IG3?

Safeguard 12.8 belongs only to Implementation Group 3. CIS places it in IG3 alone, which is the group CIS defines for enterprises with security specialists and regulated, sensitive assets facing sophisticated, targeted attacks. Smaller organizations are not required to adopt it under the CIS Controls, though they may still choose it as good practice. Confirm your implementation group against the CIS Controls Implementation Groups pages before you scope the work, and remember that any regulator or contract that cites the CIS Controls may set its own expectations.

How do prerequisites 1.1 and 4.2 affect the work for Safeguard 12.8?

The CIS Controls Assessment Specification lists Safeguard 1.1, the detailed enterprise asset inventory, and Safeguard 4.2, a secure configuration process for network infrastructure, as prerequisites for measuring 12.8. In practice you cannot prove that every administrative asset is properly configured unless you first know which assets exist. Without a reliable inventory, the Compliance metric for administrative assets has no reliable denominator. A documented configuration process under 4.2 gives the test a baseline to compare against. If either is weak, expect the first phase of work to be cleanup, not new build-out.

Are open-source tools enough to meet Safeguard 12.8?

Open-source tools can cover much of the technical work. For example, OPNsense is a BSD-2-Clause stateful packet filter whose rules pass, block or reject traffic by source, destination, port and protocol, and it can log each rule match. That is useful for enforcing segmentation and blocking internet access from administrative segments. Asset inventory, configuration monitoring and identity controls require their own tools, which you should select against your environment. Confirm that each chosen tool produces the records you need to show configuration status, because the Safeguard is measured on evidence, not on the software name.

How does an auditor test Safeguard 12.8?

An assessor typically starts with your administrative asset population, checks that it is complete against the inventory, then samples devices to confirm they are segregated from the primary network, lack internet access and meet your hardened configuration baseline. The CIS Controls Assessment Specification scores the Safeguard with a Compliance metric, the share of properly configured administrative assets. Expect requests for firewall rule exports, network diagrams, configuration reports, change records and evidence of periodic review. Only an independent auditor or assessor issues a finding or report. A partner can help you prepare that evidence but cannot certify the result.

How DeployOpen scopes and prepares evidence for Safeguard 12.8

DeployOpen works on Safeguard 12.8 as a fixed-scope engagement with the scope, deliverables and timeline agreed in writing before any work starts. For this Safeguard, the scope usually begins with an inventory of every administrative task the organization performs, such as directory administration, network device changes, hypervisor management and cloud console access, because the Safeguard applies to all administrative work or work that needs administrative access. The written scope should name which administrative workloads move to dedicated resources, which network segments they must be separated from, and which administrators are in the group. Ask for this list to be a deliverable in its own right, since the CIS assessment specification measures the share of properly configured administrative assets against it. DeployOpen builds and hardens the segmented administrative environment inside the client's own cloud accounts, data center or air-gapped network. Typical components include a dedicated administrative network segment, firewall rules that block outbound internet access from administrative hosts, and the admin workstations or jump hosts themselves. On the firewall side, the rules can be written in OPNsense with aliases for the administrative hosts and logging enabled on each rule match, so that blocked and allowed flows are visible in the live log view. The organization keeps ownership of the controls, approves each rule change, and decides which administrative tasks are permitted from the dedicated resources. DeployOpen prepares the configuration records and evidence that an assessor will ask for: rule exports, host build baselines, the segment design, firewall logs covering the administrative segment, and a record of which assets pass the configuration check. DeployOpen does not issue audit reports, attestations or certifications. Independent auditors and certification bodies do that work, and they decide whether the evidence is sufficient. Before starting, confirm with the chosen assessor which evidence formats they accept and how long they expect logs to be retained.

Safeguard 12.8 Dedicated administrative computing resources