A water plant vendor account remains in Domain Admins "temporarily" for years. What should the finding stress?
Select an answer to reveal the explanation.
Short Explanation
"Temporary" Domain Admin that lasts years is just permanent Domain Admin with better storytelling. NDAs do not shrink the technical blast radius of standing vendor privilege. Time-box elevation and remove it when the job ends.
Full Explanation
Standing membership in Domain Admins for external vendors creates durable high-impact compromise paths if that account is phished, reused, or breached. Contractual NDAs and SCADA support roles do not mitigate directory privilege. Vendor principals can hold privileged group membership just like employees. Report never-expiring "temporary" elevation as both governance and technical risk.