What an auditor, or Sekit's evidence engine, asks for.
Local admin and removable-media controls
The rules on who may have administrator rights on their own device and on the use of USB sticks and external drives.
From the Sekit evidence catalog
In practice
Privileged access fails audits most often on the local admin question, not the domain admin one. What works: separate admin accounts from everyday accounts so nobody does routine work while logged in as an administrator, grant local admin only on approval and per need, and vault or time-limit privileged access rather than leaving it standing. Cloud roles need the same discipline: MFA required everywhere and role-based permissions instead of a handful of accounts with standing owner access. Auditors pull the list of everyone with admin rights, on laptops and in the cloud console, and ask who approved each one and when it was last reviewed.
Common gaps
Several long-serving employees still hold local administrator rights granted years ago for a project that ended, with no record of a recent re-justification.
Cloud console access includes a handful of accounts with standing owner-level permissions instead of role-based access scoped to what each person needs.
The privileged access register exists but was not updated when two administrators left the company, so their accounts remained active for weeks.
Questions your auditor will ask
How is administrator access separated from everyday user accounts?
Administrative privileges live in dedicated accounts separate from daily-use accounts, granted only with management approval and tracked in a current register.
Who currently has local administrator rights, and how was that access approved?
A short, approved list of people, reviewed on a regular schedule, and every grant is tied to a specific need documented at the time of approval.
Is multi-factor authentication required for privileged access to cloud environments?
Yes, MFA is enforced for everyone with cloud access, with role-based permissions replacing standing administrator rights wherever the platform supports it.
How often is privileged access reviewed to remove rights no longer needed?
Cloud and local admin access are both reviewed on a recurring cycle, trimming permissions that exceed the role and removing leavers' access immediately.
Where regulation demands it
NIS2 art. 11.3 specifically requires controls for privileged and administrative accounts, separate from ordinary access. ENS op.acc.4 expects a formal process governing how access rights are granted and withdrawn.
Related controls
Via the shared Sekit CSF topic, not the framework's own index.