What it asks for. This control expects the allocation and use of privileged access rights to be restricted and managed. Administrative and other elevated rights should be granted only when needed and kept under tight control.
In practice. Good practice includes an authorisation process for privileged accounts, separate admin accounts from everyday accounts, strong authentication, and time-limited or just-in-time elevation where possible. Use of privileged accounts is logged and reviewed, and rights are reviewed regularly and removed promptly when roles change. Auditors look for a list of privileged accounts with owners, approval records, review results and logs.
Common gaps. Common gaps are shared admin accounts, standing privileges that are never removed, service accounts with excessive rights and no review of privileged activity.