What it asks for. Restrict and tightly control the use of utility programs that can override system and application controls.
In practice. Utilities capable of bypassing security controls, such as disk editors, debugging tools, registry editors, remote administration tools and scripting environments with elevated rights, are identified. Their installation and use are limited to authorised administrators, ideally through application allow-listing and privileged access management, and they are removed from systems where not needed. Use is logged and reviewed. Evidence includes an inventory of such utilities, access restrictions, allow-listing policies and logs of their use.
Common gaps. Powerful tools are often installed by default or left behind after troubleshooting. Attackers commonly use legitimate administration utilities already present, and many organisations do not log or monitor their use.