Privileged access permissions should:

Privileged users must be subject to periodic recertification to maintain the broad level of privileges that have been assigned to them