The use of local administrator rights on company devices is formally restricted and requires approval
Among A.5.1's topic-specific policies, Sekit's Local admin control policy keeps day-to-day accounts free of administrator rights unless granted on approval, per person and per need.
Requiring that day-to-day accounts have no admin rights, with privilege granted only on approval, is the policy basis A.8.2's tight control over privilege depends on.