If installing a printer driver is the only time you need administrator access, why does your account have it while you read every email?
That's a useful question to ask when preparing for Cyber Essentials. Administrator access gives an account more control over a device or service. It can also give a mistake more room to spread.
You can keep the ability to look after your computer while changing the account you use for ordinary work. The trick is making the safer arrangement practical enough that people keep using it.
Separate the two jobs
IASME's account guidance describes the basic arrangement: use a standard account for everyday work and a separate administrator account for tasks that need extra privileges. This applies even if you are the only person in the business.
Think of an imagined sole trader who spends most of the day preparing estimates and answering customers. They occasionally need to change a system setting. Their daily account can handle the estimates and email, while their separate administrator account is available for that specific change.
Don't assume this stops every attack. A standard account can still access its user's files and services. Separating privileges limits unnecessary exposure, while the other security controls still have work to do.
Find every place you have administrative access
Start with the laptop, then look at the services the business uses. A person might have a standard computer account but still be a powerful administrator in the company's email service.
IASME's user access FAQ confirms that separation covers local, domain and cloud administrators. A domain administrator manages a wider collection of accounts or computers, rather than just one device.
Make a short record of the account, the service it controls, the person using it and the task that needs those rights. Ask your IT provider to help interpret unfamiliar roles. Names such as owner, super user and administrator can mean different things in different products.
Don't copy passwords or recovery codes into this record. It should explain the arrangement without becoming a collection of credentials.
Change one working routine first
Before changing a person's usual account, arrange and test the approved administrator access they will need. Otherwise a well-intended tidy-up can leave them unable to get help or finish a necessary task.
Try the arrangement with one willing colleague. Ask them to carry out an ordinary morning's work, then one legitimate task that needs administrator approval. Notice where they become uncertain.
Can they tell which account is active? Do they know where to request a software installation? Does the request reach somebody who can act on it? Can that person provide support when the usual technician is away?
Write instructions around those moments. A short explanation next to the helpdesk link may be more useful than a long policy nobody opens. These are practical implementation suggestions, not additional Cyber Essentials paperwork requirements.
Make the account boundary visible
Use account names and profile labels that people can distinguish at a glance. Ask your provider whether the administration interface can have a clearly different profile picture or theme. Small cues help when several windows are open.
Ordinary email, shopping, news and document work belong in the standard account. Administration should be limited to the task requiring it. Opening a web-based administration console is an administrative activity, but that session shouldn't become someone's general browsing session.
When a job finishes, close the privileged session. If staff repeatedly leave it open because the next task is difficult to reach, look at the workflow rather than just repeating the instruction more firmly.
An installation prompt is also a decision point. If it appears unexpectedly while opening a document, staff should stop and ask for help. Knowing an administrator password doesn't make every request for it legitimate.
Check the sign-in protections separately
Account separation and stronger sign-in protection solve different problems. Having two accounts doesn't establish that either is protected properly.
The current NCSC requirements require MFA where available and always for authentication to cloud services. MFA adds another verification factor when someone signs in.
Ask your provider to demonstrate the intended sign-in for each administrative service. Then discuss recovery if a phone is lost or the usual administrator is unavailable. Keep recovery instructions controlled and accessible to the people authorised to use them.
If a supplier proposes a tool that temporarily grants privileges, get the configuration checked. IASME's FAQ distinguishes restricted elevation for the required task from giving the whole session administrative power for a period. A product name or a short expiry timer doesn't establish compliance on its own.
Deal with access that no longer has a purpose
Look for administrators added during a migration, former IT suppliers and people who changed jobs internally. Ask why each account still needs its current role.
Before changing an unfamiliar account, establish what uses it. An account supporting an automated task needs investigation rather than an unexplained deletion. Keep the decision and the checked result together so the next person understands what happened.
Set a review point that fits your business and repeat the check when responsibilities change. The aim is to make the list reflect today's work. A quarterly diary entry can help a small team, but that interval is a practical suggestion here, not a scheme rule.
Our staff offboarding checklist can help connect this review to the moment somebody leaves. Removing an old administrator is much easier when you already know what they controlled and who is taking over.