ADMIN-ML3 Restrict Administrative Privileges (ML3)
All ML2 requirements plus: Privileged access to systems, applications and data repositories is limited to only what is required for users and services to undertake their duties. Secure Admin Workstations are used in the
8
artefacts
4
held by a system
1
at each review
easy
to go live
Cloud console / configuration management
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Just-in-time access tool (Entra ID PIM, CyberArk JIT, Saviynt JIT) configuration with activation reason and approver · Cloud console / configuration management
- Endpoint compliance scan output confirming all of the above on every admin endpoint · Vulnerability scanner / patch tooling
- SIEM detection use cases against workstation and non-internet-facing server logs (lateral movement, credential dumping, AdminSDHolder) · Endpoint management (MDM / EDR)
- JIT activation logs sampled and reconciled with change tickets · SIEM / log platform
periodic reviewEvidence produced at each review
- Decommissioning or quarantine evidence for any admin endpoint that failed compliance · Endpoint management (MDM / EDR)
governing documentDocuments that govern the control
- Privileged role definition matrix showing each role has a specific scope and entitlement set · Policy repository / GRC workspace
- SAW build documentation (clean OS, App Control, no productivity software) and inventory of deployed SAWs · Policy repository / GRC workspace
- Group Policy or MDM showing HVCI Memory Integrity enabled, LSA Protection RunAsPPL enabled, Credential Guard enabled, Remote Credential Guard enforced · Policy repository / GRC workspace
First move
Automate the pull from your Cloud console / configuration management. Configuration snapshots and change history from the cloud console or IaC repository, diffed against the baseline.
Common gaps auditors find
- Least privilege expressed but enforced via broad AD groups (e.g. Domain Admins) for convenience
- SAWs deployed but used by admins for non-admin work (browsing, email)
- JIT in place for some platforms (Azure) but not for on-prem AD or Linux
- Credential Guard incompatible with legacy software so disabled on subset of fleet
- Memory Integrity disabled due to driver compatibility
- Workstation logs forwarded but only Security 4624/4625 collected, missing process and PowerShell context
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetADMIN-ML2 Restrict Administrative Privileges (ML2) · APP-ML1 Application Control (ML1)