A water plant vendor account remains in Domain Admins "temporarily" for years. What should the finding stress?
Select an answer to reveal the explanation.
Short Explanation
"Temporary" Domain Admin that lasts years is just permanent Domain Admin with better storytelling. NDAs do not shrink the technical blast radius of standing vendor privilege. Time-box elevation and remove it when the job ends.
Full Explanation
Standing privileged vendor access that never expires is a governance failure with direct technical impact. A water plant vendor account left in Domain Admins “temporarily” for years expands the trusted computing base to an external party indefinitely—credential theft, misuse, or weak vendor hygiene becomes Domain Admin risk for OT-adjacent and enterprise systems serving public water operations.
An NDA does not make indefinite Domain Admin safe. Supporting SCADA does not justify permanent Tier-0 membership without time-bound, tightly controlled access. Vendor accounts can be Domain Admins in practice when placed there; membership is not “cosmetic.”
Exam caveat: temporary elevation needs an expiry, sponsor, and least-privilege alternative (tiered admin, JIT, scoped groups). CPTS findings should connect governance failures to technical privilege paths.
Operational check: remove standing vendor DA membership, replace with time-limited PAM access and monitored jump hosts, rotate credentials, and review other civic vendor accounts for similar standing privilege. Time-bound vendor access protects ratepayers by shrinking how long an external compromise can equal Domain Admin over water-utility identity.