Information Security Handbook

Least privilege/role separation

Every individual that has a qualified business justification in your organization to have an administrator account in most cases does not require the same level of privileges as an administrator:

• Some administrators will administer enterprise-wide capabilities and need greater permissions within the enterprise information system
• Other administrators may maintain a single IT component and do not require permissions that will affect the entire enterprise

Ensure that you properly architect your administrator user roles as part of your information system design so that you properly separate administrative roles as part of operations and maintenance.