CIS Critical Security Controls v7.1 (SANS Top 20)

12.8 Establish and Maintain Dedicated Computing Resources for All Administrative Work Devices
Establish and maintain dedicated computing resources, either physically or logically separated, for all administrative tasks or tasks requiring administrative access. The computing resources should be segmented from the enterprise’s primary network and not be allowed internet access. 

12.8 Реализовано и поддерживается выделение отдельных вычислительных ресурсов для любых задач администрирования
Ресурсы для работы под учетной записью администратора находятся в отдельном сетевом сегменте, физически или логически. 

/STANDARD
A workstation or a server used for administration actions must, under no circumstances, have access to the Internet, due to the risks that web browsing (websites containing malware) and email (potentially infected attachments) bring to its integrity. 

For other administrator uses requiring the Internet (viewing documentation online, their email, etc.), it is advisable to provide them with a separate workstation. Failing this, access to a remote virtual infrastructure for office applications from an admin device is possible. The reverse, consisting of providing remote access to an admin infrastructure from an office device, is not advisable as it can lead to a privilege elevation in the event admin authenticators are recuperated. 

/STANDARD
An administration network interconnects, among others, the administration devices or servers and the device administration interfaces. Within the logic of segmentation for the organization’s global network, it is essential to specifically segregate the administration network from the user office network, to prevent any intrusion by redirection from a user device to an administration resource. 

Depending on the organization’s security needs, it is advisable:

A.9.2.3 Управление привилегированными правами доступа 
Мера обеспечения информационной безопасности: Распределение и использование привилегированных прав доступа следует ограничивать и контролировать 

А.5.18 Права доступа
Права доступа к информационным и иным связанным с ней активам должны предоставляться, пересматриваться, изменяться и удаляться в соответствии с специфической тематической политикой и правилами управления доступом организации.

А.8.2 Привилегированные права доступа
Должны ограничиваться и управляться назначение и использование привилегированных прав доступа.

А.8.2 Privileged access rights
The allocation and use of privileged access rights shall be restricted and managed.

А.5.18 Access rights
Access rights to information and other associated assets shall be provisioned, reviewed, modified and removed in accordance with the organization’s topic-specific policy on and rules for access control.