Admins should do everyday tasks from a normal account, not their admin account.
What it actually means
People with admin rights should use a separate non-privileged account for routine work — email, web, documents — and only switch to the privileged account for actual admin tasks. This limits the damage if their everyday session is compromised.
Pass or fail — an assessor needs a "yes" to each
- Do privileged users have separate non-privileged accounts for routine work?
- Is admin access used only for admin tasks?
What to have ready
- Account configuration showing separate admin vs. daily accounts
- Policy requiring non-privileged accounts for routine use
Where teams trip up
- Admins browsing the web and reading email as a domain admin
- A single account with standing admin rights used for daily work
See where this control puts your score
Run all 110 requirements free in about 10 minutes — or draft your SSP language for this control. No signup.
Calculate your SPRS score →Draft your SSP language →Connected requirements
3.1.5 — Least privilege3.1.7 — Restricting privileged functions3.13.3 — Separating user and admin functions
More in Access Control (3.1)
3.1.1 — Limit who (and what) can get in3.1.2 — Limit what users can do3.1.3 — Control the flow of CUI3.1.4 — Separate duties3.1.5 — Least privilege (especially for admins)3.1.7 — Restrict and log privileged functions3.1.8 — Limit failed logons3.1.9 — Show privacy and security notices3.1.10 — Lock idle screens3.1.11 — End sessions automatically3.1.12 — Monitor and control remote access3.1.13 — Encrypt remote access sessions3.1.14 — Funnel remote access through managed points3.1.15 — Authorize privileged remote actions3.1.16 — Authorize wireless access first3.1.17 — Protect wireless with authentication + encryption3.1.18 — Control mobile device connections3.1.19 — Encrypt CUI on mobile devices3.1.20 — Control connections to external systems3.1.21 — Limit portable storage on external systems3.1.22 — Control what goes on public systems