Administrative tiering means separating accounts by what they can touch, so an administrator who manages workstations cannot also log in to domain controllers. The ICO said Capita used no tiering model, which let an attacker escalate privileges and move across domains, and noted the weakness had been flagged at least three times without a fix.
What tiering is
In a typical tiered design there are three layers. Tier 0 holds the identity systems themselves, such as domain controllers and the tools that manage them. Tier 1 holds servers and applications. Tier 2 holds user devices.
Each layer gets its own admin accounts. A Tier 2 administrator signs in only to user devices. Their credentials never touch a server, so if an attacker steals them from a compromised laptop, the stolen account opens nothing more valuable than laptops.
Why the ICO cared
The ICO's findings say that without tiering, the attacker could escalate privileges and move laterally across domains. Lateral movement is how a single downloaded file on one machine becomes nearly one terabyte of stolen data and ransomware across a large organization.
The regulator's recommendations include applying least privilege and following National Cyber Security Centre guidance on preventing lateral movement. Tiering is one concrete way to do that.
A first step for a small team
You do not need a full redesign to start:
- List every account that has administrative rights, including service accounts.
- Give each human administrator a separate daily account with no admin rights.
- Stop administrators signing in to ordinary workstations with their admin account.
- Move the highest value systems, identity first, behind admin accounts used for nothing else.
- Turn on alerts for any admin account used outside its tier.
Step 3 is the one that most often stops an attack from spreading, and it costs almost nothing.
The part about being warned
The detail worth repeating is that the weakness was raised at least three times and never fixed. Tracking a finding is not fixing it. Give each finding an owner and a date, and escalate when the date passes.
An audit finding that has been open for three review cycles should reach someone senior. If it does not, your process is generating paperwork, not risk reduction.
How to know it is working
Test by assumption. Pick one workstation, assume it is compromised, and ask which credentials were present on it. If any of them can administer a domain controller, tiering is not working yet.
Safeguard's asset discovery can help you find the systems and accounts you did not know to list, and its policies and gates can record the standard you expect. The access design itself is work for your identity and infrastructure team.
Quick check
Does tiering replace multi-factor authentication?
No. They solve different problems. MFA makes stolen passwords harder to use. Tiering limits what a stolen admin credential can reach.
Is tiering only for large enterprises?
No. Separating daily and admin accounts and keeping admin logins off ordinary workstations works at any size.
Sources
Last reviewed: 19 October 2026.
