Guideline for a healthy information system v.2.0 (EN)

/STANDARD
 In the event of an incident, in order to facilitate the attribution of an action within the information system or the identification of possible compromised accounts easier, access accounts must be nominative. 

The use of generic accounts (e.g : admin, user) must be marginal and they must be able to be associated with a limited number of individuals. 

Of course, this rule does not stop you from retaining service accounts attributed to an IT process (e.g : apache, mysqld). 

In any event, generic and service accounts must be managed according to a policy that is at least as stringent as the one for nominative accounts. Moreover, a nominative administration account, different from the user account, must be attributed to each administrator. The usernames and authentication secrets must be different (e.g : pmartin as a username, adm-pmartin as an admin username). This admin account, having more privileges, must be exclusively dedicated to administration actions. Furthermore, it must be used in environments dedicated to administration in order that no connection traces or password hashes are left in a more exposed environment.