Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.

By limiting privileged functions such as being able to change system settings, modify logs, and install software you reduce cyber risk. By capturing logs on the execution of privileged functions you can identify policy violations and malicious activity.

Only employees responsible for administering, securing, and auditing your systems should have privileged accounts. All other employees should be given non-privileged accounts. Configure your systems to collect logs on the execution of privileged functions such as changes to system settings and the installation of software.