We're having an internal debate within the NHS organisation I work for, around securing admin usernames. Our usernames are generally based on our names (e.g. tom jones username = tojo0001). Admin usernames are based on the low-level account (e.g. tom jones admin = a.tojo0001).
Some of the team want to randomise admin usernames so that tom jones admin = tyl99123). Whilst I see the security benefit of the random username, it feels clunky and less manageable. In addition, our systems authentication requires a strong password, multifactor authentication, compliant device and low sign-in risk (from online risk analysis).
In these circumstances, I believe randomising usernames is a low-security benefit vs a high management overhead.
Are there any official NIST, NCSC, ISO or OWASP recommendations on this?