Skip to main content

Pro audit program · v1.0

Privileged Access Snapshot

A 6-question snapshot of privileged-account hygiene: shared admins, breakglass, vaulting, JIT, session recording.

  • General target area
  • NIST CSF framework
  • 7 controls in this program
  • Cyentrix Cyentrix Trusted Author
Sign in to run → Back to library

About this program

A 6-question snapshot of privileged-account hygiene: shared admins, breakglass, vaulting, JIT, session recording.

Risks addressed

  • Critical A compromised admin account allows full-environment takeover
  • High Shared admin credentials prevent attribution
  • High Standing privileged access expands the attack window
  • Medium No audit trail of privileged actions

Controls (7)

  1. Inventory of privileged accounts maintained

    High

    This control requires organizations to establish and maintain a comprehensive, up-to-date inventory of all privileged accounts across systems, applications, databases, cloud platforms, and network devices. The inventory must include account attributes such as account name, system/application location, access level, account…

    How to test + evidence

    Testing procedure: Request the privileged account inventory; spot-check 5 accounts against directory roles.

    Evidence to collect: Privileged account inventory (CSV).

  2. No shared admin credentials

    Critical

    This control prohibits the use of shared administrative credentials across multiple users or systems. Each administrator must be assigned a unique, individually attributable account for privileged access. Shared credentials prevent accurate audit trails, enable lateral movement after single credential compromise,…

    How to test + evidence

    Testing procedure: Interview admins; review whether any role is shared. Check vault for shared secrets.

    Evidence to collect: Vault audit log; admin role membership.

  3. Break-glass accounts protected

    High

    Break-glass accounts are emergency privileged accounts used when normal authentication mechanisms fail or during critical incidents requiring immediate elevated access. This control ensures these accounts are secured through strong passwords, monitored continuously, restricted from routine use, and subject to strict…

    How to test + evidence

    Testing procedure: Verify break-glass accounts exist, credentials are sealed, alerts fire on use.

    Evidence to collect: Sealed-envelope register + alert config screenshot.

  4. Privileged access vaulted (PAM)

    High

    Privileged Access Management (PAM) vaulting ensures that credentials with elevated permissions—such as domain administrator accounts, root passwords, service accounts, and secrets—are stored in a centralized, encrypted vault and accessed only through controlled workflows. The vault enforces checkout/check-in workflows, automatic password…

    How to test + evidence

    Testing procedure: Confirm admin passwords/keys are in a PAM solution; passwords rotated after checkout.

    Evidence to collect: PAM tool config; rotation log.

  5. Just-In-Time elevation in use

    Medium

    Just-In-Time (JIT) elevation grants administrative or elevated privileges only when needed, for a limited duration, rather than persistently assigning standing privileges. Users request elevated access through an automated workflow, receive time-bound credentials or role assignments, and permissions automatically expire after…

    How to test + evidence

    Testing procedure: Verify admins request elevation; standing access is the exception, not the default.

    Evidence to collect: PIM/Approval workflow export.

  6. Privileged session activity logged

    High

    This control ensures that all activities performed during privileged user sessions (such as administrative actions, elevated access usage, and system configuration changes) are captured in tamper-resistant logs. Organizations must configure logging systems to record session metadata (user identity, timestamp, source…

    How to test + evidence

    Testing procedure: Confirm privileged actions are logged centrally and reviewed monthly.

    Evidence to collect: SIEM query + reviewer sign-off.

  7. Quarterly access recertification of admins

    Medium

    This control requires a formal review and re-approval of all administrative and privileged account access rights at least once per calendar quarter. During each review cycle, account owners or business managers confirm that each privileged user still requires their current…

    How to test + evidence

    Testing procedure: Pull the most recent privileged access recert; verify owners signed off within SLA.

    Evidence to collect: Recert report with attestations.