CIS Controls v8
CIS Control 5: Account Management

CIS Controls v8 CIS-5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts

Confine administrator privileges on enterprise assets to accounts used only for administration. Everyday computing, for example web browsing, email and office productivity tools, is to be done from the user's main account without privileges.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 84 controls across 27 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

FedRAMP High · 11 controls

  • AC-2(7) Privileged User Accounts
  • AC-5 Separation of Duties
  • AC-6 Least Privilege
  • AC-6(1) Authorize Access to Security Functions
  • AC-6(10) Prohibit Non-Privileged Users from Executing Privileged Functions
  • AC-6(2) Non-Privileged Access for Nonsecurity Functions
  • AC-6(5) Privileged Accounts
  • AU-9(4) Access by Subset of Privileged Users
  • CM-5 Access Restrictions for Change
  • CM-5(5) Access Restrictions for Change | Privilege Limitation for Production and Operation (CM-5(5))
  • SC-2 Separation of System and User Functionality

FedRAMP Moderate · 11 controls

  • AC-2(7) Privileged User Accounts
  • AC-5 Separation of Duties
  • AC-6 Least Privilege
  • AC-6(1) Authorize Access to Security Functions
  • AC-6(10) Prohibit Non-Privileged Users from Executing Privileged Functions
  • AC-6(2) Non-Privileged Access for Nonsecurity Functions
  • AC-6(5) Privileged Accounts
  • AU-9(4) Access by Subset of Privileged Users
  • CM-5 Access Restrictions for Change
  • CM-5(5) Access Restrictions for Change | Privilege Limitation for Production and Operation (CM-5(5))
  • SC-2 Separation of System and User Functionality

PCI DSS 4.0 · 10 controls

  • 3.6.1.2 3.6.1.2 Permitted storage forms for secret and private keys
  • 7.2.2 7.2.2 User access assigned by job function and least privilege
  • 8.2.1 8.2.1 Unique ID assigned to every user
  • 8.2.2 8.2.2 Shared and generic IDs only by exception
  • 8.4.1 8.4.1 MFA for non-console administrative CDE access
  • 9.2.3 9.2.3 Physical protection of network hardware and lines
  • 9.4.4 9.4.4 Management approval for media leaving facility
  • 6.5.4 6.5.4 Separate roles between production and pre-production
  • 7.2.5 7.2.5 Application and system accounts least privilege
  • 8.6.1 8.6.1 Interactive use of system accounts controlled

AWS Well-Architected Security Pillar · 5 controls

CMMC 2.0 · 5 controls

Azure Security Benchmark · 4 controls

  • ASBv3-AM-4 Limit access to asset management
  • ASBv3-GS-6 Define and implement identity and privileged access strategy
  • ASBv3-PA-7 Follow just enough administration (least privilege) principle
  • PA-1 Separate and limit highly privileged/administrative users

ISO 27001:2022 · 4 controls

  • 5.3 Segregation of duties
  • 8.18 Use of privileged utility programs
  • 8.2 Privileged access rights
  • 8.4 Access to source code

NIST SP 800-171 Rev 3 · 4 controls

NIST SP 800-53 Rev 5 · 4 controls

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 3 controls

ISO 27002:2022 · 3 controls

  • 5.3 Segregation of duties
  • 8.18 Use of privileged utility programs
  • 8.2 Privileged access rights

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 2 controls

  • ANSSI-HYG-08 Identify Each Person by Name and Separate User and Administrator Roles
  • ANSSI-HYG-29 Limit Administration Rights on Workstations to Operational Need

Australian Information Security Manual · 2 controls

  • ISM-0445 Dedicated privileged user accounts
  • ISM-1175 Blocking internet, email and web for privileged accounts

HIPAA Security Rule · 2 controls

NIST SP 800-66 Rev 2 · 2 controls

ACSC Essential Eight · 1 control

  • E8-ADMIN-ML1 Restrict Administrative Privileges (ML1)

ASD Strategies to Mitigate Cyber Security Incidents · 1 control

  • ASD37-18 Restrict administrative privileges (Essential)

Australia Consumer Data Right - Banking (CDR) · 1 control

  • AUCDR-IS-1 Limit risk of unauthorised access to the CDR data environment

Australia My Health Records Act 2012 · 1 control

C5 (Germany) · 1 control

CIS Controls v8.1 · 1 control

  • 5.4 Restrict Administrator Privileges to Dedicated Administrator Accounts

ISO 27701:2019 · 1 control

  • 6.6.2 User access management

NIS2 Directive · 1 control

  • Art.21.2.g Basic cyber hygiene practices and cybersecurity training

NIST Cybersecurity Framework 2.0 · 1 control

  • NIST-CSF-PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties

NIST SP 800-172 · 1 control

  • 3.13.2e Introduce Unpredictability into System Operations

SOC 2 · 1 control

  • SOC2-CC6.3 CC6.3 Role-based access, least privilege and segregation of duties

UK Cyber Essentials · 1 control

  • CE-AC.5 Separate Admin Accounts for Administrative Activities

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in CIS Control 5: Account Management

You are reading one control. How much of CIS Controls v8 have you already done?

CIS Controls v8 CIS-5.4 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of CIS Controls v8 your existing evidence covers. Hold ISO 27001:2022 and 102 of 153 CIS Controls v8 controls already carry evidence.

If you hold ISO 27001:202266.7% covered · 51 gapsIf you hold FedRAMP Moderate62.7% covered · 57 gapsIf you hold NIST SP 800-53 Rev 557.5% covered · 65 gapsIf you hold NIST Cybersecurity Framework 2.050.3% covered · 76 gapsIf you hold ISO 27002:202249.7% covered · 77 gapsIf you hold Azure Security Benchmark49% covered · 78 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 240 were rejected on the ISO 27001:2022 pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 84 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll CIS Controls v8 controls