I am performing analysis into the security of our org. Previously we had very relaxed rules around privileged user access in our org. Basically we give out too many System Admin profiles, but because we do have some regulation around this, other teams have basically found a loophole where they could do what they want as long as they create a new profile and don't call it any sort of "Admin".
Yes, our practices are long overdue for overhaul. My question is what specific permissions should be flagged and removed from users who are not technically System Admins?
Some obvious ones to me:
Modify All Data
Assign Permission Sets
Manage Internal Users
Is there a list or article somewhere that can help me with this? Or any recommendations that have implemented for any of you?