SekitCrosswalk
ENES
Start now
Cyber Essentials · derived mapping target

CE4.2Control administrative privileges

Use separate accounts for administrative tasks (never for email or web browsing), grant special access privileges only where needed, and remove them as soon as a role changes or they are no longer required.

Mapping at a glance
CE4.2Control administrative privilegesCyber Essentials
RCF-0006Roles & responsibilitiesGovernance & Risk · TechnicalRCF-0067Least privilege / RBACIdentity & Access Management · PolicyRCF-0068Least privilege / RBACIdentity & Access Management · ProcessRCF-0069Least privilege / RBACIdentity & Access Management · TechnicalRCF-0070Privileged access managementIdentity & Access Management · Policy

CE4.2 is covered by 15 Sekit CSF controls. +10 more in the table below. Open in the full graph →

Mapped from the Sekit CSF

The Sekit controls that cover this requirement, lens by lens.

RCF-0006Roles & responsibilities · TechnicalRCF-0067Least privilege / RBAC · PolicyRCF-0068Least privilege / RBAC · ProcessRCF-0069Least privilege / RBAC · TechnicalRCF-0070Privileged access management · PolicyRCF-0071Privileged access management · ProcessRCF-0072Privileged access management · TechnicalRCF-0085Access reviews (recertification) · PolicyRCF-0086Access reviews (recertification) · ProcessRCF-0166Local admin control · PolicyRCF-0167Local admin control · ProcessRCF-0168Local admin control · TechnicalRCF-0334Cloud IAM · PolicyRCF-0335Cloud IAM · ProcessRCF-0336Cloud IAM · Technical

ISO/IEC 27001:2022 counterparts

Reached through the Sekit CSF controls both map to — a mapping, not a formal equivalence.

A.8.2 Privileged access rightsA.5.18 Access rightsA.5.15 Access controlA.8.15 LoggingA.8.3 Information access restrictionA.8.18 Use of privileged utility programsA.8.16 Monitoring activitiesA.5.1 Policies for information securityA.8.5 Secure authenticationA.5.16 Identity managementA.5.23 Information security for use of cloud servicesA.5.3 Segregation of duties

NIST CSF 2.0 counterparts

PR.AA-05 Access permissions managedPR.AA-03 Users and devices authenticatedPR.AA-01 Identities and credentials managedGV.RR-01 Leadership accountability for cyber riskGV.RR-02 Roles and responsibilities establishedGV.RR-03 Resources allocated for cybersecurityGV.RR-04 Cybersecurity in human resources

Evidence that proves this control

What an auditor, or Sekit's evidence engine, asks for.

Local admin and removable-media controls
The rules on who may have administrator rights on their own device and on the use of USB sticks and external drives.
From the Sekit evidence catalog

Related controls

Via the shared Sekit CSF topic, not the framework's own index.

CE4.1 Manage the account lifecycleCE4.3 Require multi-factor authentication
Ask Sekura: “What evidence proves CE4.2?”
Also via MCP, free with account