Control 3.1.5

★What This Means in Plain English

Every user and system process should have only the minimum level of access needed to perform their job. Admin accounts should be used only for admin tasks, and daily work should be done with standard accounts.

✓How Petronella Implements This Control

Petronella Technology Group implements this control through:

• Tiered administrative model with separate accounts for daily use and privileged operations
• Microsoft Entra ID Privileged Identity Management (PIM) providing just-in-time admin access
• Group Policy Objects removing local administrator rights from standard workstations
• Application whitelisting preventing unauthorized software execution
• Quarterly privilege audits using ComplianceArmor to detect and remediate privilege creep
• Sophos XDR endpoint policies restricting elevated process execution

🔎Assessment Guidance

Assessors will verify that admin accounts are separate from daily-use accounts, check that privileged access is time-limited and logged, review GPOs enforcing least privilege on workstations, and verify that privilege escalation requires approval.

⚠Common Implementation Gaps

• Users running daily operations with domain admin accounts
• Local administrator rights on all workstations
• Service accounts with domain admin privileges
• No periodic review of privilege levels
• Developers with production database admin access

⇄Cross-Framework Mapping