Mechanisms exist to restrict and control privileged access rights for users and services.
Does the organization restrict and control privileged access rights for users and services?