AC.L1-b.1.ii — Limit users to what they’re allowed to do in 2 simple steps.

Give people only the permissions they need.
Ensure that regular staff doesn’t have administrator rights on their computers, shared drives, or systems.