Restrict administrator privileges to dedicated administrator accounts on enterprise assets. Conduct general computing activities, such as internet browsing, email, and productivity suite use, from the user’s primary, non-privileged account.
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| CIS-5.4 | Restrict Administrator Privileges to Dedicated Administrator Accounts | mitigates | T1078 | Valid Accounts |
Comments
Separating privileged accounts from daily-use accounts limits the privilege available if a primary account is compromised.
References
|
| CIS-5.4 | Restrict Administrator Privileges to Dedicated Administrator Accounts | mitigates | T1078.002 | Domain Accounts |
Comments
Dedicated domain admin accounts reduce the chance that routine domain account compromise yields domain-level privileges.
References
|
| CIS-5.4 | Restrict Administrator Privileges to Dedicated Administrator Accounts | mitigates | T1078.003 | Local Accounts |
Comments
Restricting local admin rights to dedicated accounts reduces local privilege availability in routine user sessions.
References
|
| CIS-5.4 | Restrict Administrator Privileges to Dedicated Administrator Accounts | mitigates | T1078.004 | Cloud Accounts |
Comments
Dedicated cloud admin accounts reduce privileged cloud exposure during normal user activity, though cloud-specific PAM controls are not required by the safeguard.
References
|
| CIS-5.4 | Restrict Administrator Privileges to Dedicated Administrator Accounts | mitigates | T1548 | Abuse Elevation Control Mechanism |
Comments
The safeguard limits which accounts can legitimately elevate, reducing the opportunity to abuse elevation paths from compromised routine accounts.
References
|
| CIS-5.4 | Restrict Administrator Privileges to Dedicated Administrator Accounts | mitigates | T1548.002 | Bypass User Account Control |
Comments
If routine accounts lack admin rights, UAC bypass from normal browsing/email sessions is less useful to an adversary.
References
|
| CIS-5.4 | Restrict Administrator Privileges to Dedicated Administrator Accounts | mitigates | T1548.003 | Sudo and Sudo Caching |
Comments
Dedicated admin accounts reduce privileged sudo exposure during routine activity, though sudo policy hardening is outside the safeguard.
References
|
| CIS-5.4 | Restrict Administrator Privileges to Dedicated Administrator Accounts | mitigates | T1548.005 | Temporary Elevated Cloud Access |
Comments
If dedicated administrator accounts include cloud privileged-access workflows or separate privileged cloud identities, the safeguard can reduce abuse of temporary elevated cloud access.
References
|