Control 3.1.6

★What This Means in Plain English

When administrators are reading email, browsing the web, or doing other non-admin tasks, they must use a standard user account, not their admin account. This limits the damage if their session is compromised.

✓How Petronella Implements This Control

Petronella Technology Group implements this control through:

• Mandatory separate standard user accounts for all IT staff daily operations (email, web browsing)
• Admin accounts restricted to administrative jump servers only via Conditional Access policies
• Microsoft Entra PIM requiring explicit activation for admin role usage
• Sophos XDR monitoring for admin account usage in non-administrative contexts
• Automated alerts when privileged accounts are used for non-privileged activities

🔎Assessment Guidance

Assessors will verify that admin personnel have separate standard accounts, test that admin accounts cannot be used for general web browsing or email, review logs for inappropriate use of privileged accounts, and verify policy documentation.

⚠Common Implementation Gaps

• Admins using privileged accounts for daily email and web browsing
• No separate accounts provisioned for administrative staff
• Admin accounts not restricted to specific workstations or jump servers
• No monitoring for misuse of privileged accounts
• Lack of policy requiring non-privileged accounts for routine tasks

⇄Cross-Framework Mapping