SC.2.003 — Separate User and System Management Functionality

What SC.2.003 means in plain English

The account you use to check email and browse the web should not be the same account you use to manage servers and install software. Create separate admin accounts for IT tasks. Your day-to-day account should be a standard user. When you need to do something administrative, use "Run as Administrator" or log in with your admin credentials. This way, if your regular account gets compromised by a phishing email, the attacker does not get admin powers.

The assessment question

“Do administrators use separate accounts for day-to-day work and system administration tasks, ensuring that standard user activities like email and web browsing are not performed with administrative credentials?”

How to implement SC.2.003

1. For anyone who performs IT administration: create a separate admin account (e.g., "john.admin") in addition to their regular user account (e.g., "john"). The admin account should only be used for administrative tasks.
2. Remove the regular user account from the local Administrators group on all workstations. Day-to-day work should be done as a standard user.
3. When administrative tasks are needed, use "Run as Administrator" or Remote Desktop with the admin account — never browse the web, read email, or open documents with the admin account.
4. Configure Windows User Account Control (UAC) to "Always Notify" so any elevation prompt requires the admin credentials explicitly.

Evidence your assessor will ask for

• List of admin accounts showing they are separate from regular user accounts
• Screenshots showing admin users have a standard (non-admin) account for daily work
• UAC configuration set to "Always Notify" (screenshot of UAC settings)
• Written policy requiring separation of admin and user accounts

More System and Communications Protection controls