CIS-5.4 Restrict Administrator Privileges to Dedicated Administrator Accounts

• T1078 Valid Accounts — Separating privileged accounts from daily-use accounts limits the privilege available if a primary account is compromised. • T1078.002 Domain Accounts — Dedicated domain admin accounts reduce the chance that routine domain account compromise yields domain-level privileges. • T1078.003 Local Accounts — Restricting local admin rights to dedicated accounts reduces local privilege availability in routine user sessions. • T1078.004 Cloud Accounts — Dedicated cloud admin accounts reduce privileged cloud exposure during normal user activity, though cloud-specific PAM controls are not required by the safeguard. • T1548 Abuse Elevation Control Mechanism — The safeguard limits which accounts can legitimately elevate, reducing the opportunity to abuse elevation paths from compromised routine accounts. • T1548.002 Bypass User Account Control — If routine accounts lack admin rights, UAC bypass from normal browsing/email sessions is less useful to an adversary. • T1548.003 Sudo and Sudo Caching — Dedicated admin accounts reduce privileged sudo exposure during routine activity, though sudo policy hardening is outside the safeguard. • T1548.005 Temporary Elevated Cloud Access — If dedicated administrator accounts include cloud privileged-access workflows or separate privileged cloud identities, the safeguard can reduce abuse of temporary elevated cloud access.