Identity and Access Management
Technology solutionControl who can administer critical systems, for what purpose and for how long, and prepare audit evidence early.
Privileged access management (PAM) places a control layer between the person requesting access and the administrative account on a server or database. It verifies identity, ties the request to a system, task, and duration, and applies approvals and policy before opening the authorized path. On covered channels, the session record can be tied to the requester even when a shared administrator account is used. The team can grant task-specific access without making it permanent and later review who requested it, who approved it, and what was recorded.
Privileged access management connects just-in-time privileged access to approval records and privileged session recording on supported channels.
A database administrator can receive temporary access for an approved maintenance task. The security team can then review the access and session records.
PAM is a specialized security system used to manage and safeguard high-priority accounts within digital and operational environments.
The technology is based on centralized access control for sensitive accounts, distinctive identity management, session monitoring, activity recording, and restricted access policies.
The technology works by creating a centralized control layer between users and sensitive systems, so that identity is verified, privileges are restricted, and all processes associated with administrative or sensitive accounts are recorded.
Privileged access management (PAM) helps protect critical systems by controlling who may access administrative systems and sensitive data, and what those users can do within the managed scope.
Instead of relying on fixed passwords or open permissions, the technology regulates access to administrative accounts through centralized policies, records all transactions, and continuously monitores activities.
The technology also contributes to simplifying daily processes of information technology and cybersecurity through automation and central management of accounts and powers.
This capability is usually relevant when these signals appear in the operating environment.
Core capabilities that turn the requirement into practical controls.
The impact security teams and leadership can expect from the right implementation.
Feature availability depends on the product version, target systems and protocols, deployment model, and integrations.
Manage administrative credentials centrally and constrain their use by policy instead of giving users standing privileges.
Grant only the access and privileges needed on the target system within an approved time window, then let the entitlement expire under policy.
Restrict unauthorized commands on supported channels. Test which commands are denied before expanding the policy to administrative paths.
Restricting privileged account use reduces opportunities to reuse it on other systems. This layer complements network segmentation and endpoint controls.
Monitor sessions that traverse supported channels and retain a reviewable log or recording to understand what happened.
Tie shared-account use to the requester's identity, target system, and session time on paths that support that association.
Signals such as atypical access attempts or timing help prioritize sessions for review without treating every anomaly as a confirmed incident.
Review requests, approvals, and privilege use through records linking user identity to the decision and session where the integration supports it.
Discover covered administrative accounts and review ownership, onboarding, privilege changes, and retirement.
Require additional verification for privileged access according to policy and identity integration. Test denial when a required factor is missing.
Connect sign-in to the enterprise identity provider where supported. Successful sign-in is separate from authorization for a system or task.
Identify the requester, target account and system, the privileges required, and who is authorized to approve them.
Review onboarded accounts and assets from one place and identify what remains outside inventory scope.
Manage approval, duration, and privilege rules centrally and apply them to integrated systems.
Route requests to the appropriate approver and record the decision. Automate recurring actions where the solution supports them.
Evaluate consistent account policies across data centers, cloud services, and virtual environments while testing each access path separately.
Identify supported applications, network devices, servers, databases, and cloud services by connector, protocol, and release.
Test links to identity providers and operational tooling as needed, and assess what an outage would mean for authorized access.
Where self-service is available, users request a named system, task, and duration in a traceable workflow instead of asking for permanent rights outside it.
A common request and policy workflow can reduce manual steps. Measure the effect in an operational pilot without assuming a fixed turnaround.
Document when an exception is allowed, who can approve it, and how it expires so it does not become a standing bypass.
Policy settings, request samples, and session records help demonstrate how the organization implemented access controls on covered systems.
Review accounts, privileges, and exceptions with system owners to decide what remains necessary and what should be revoked.
Approval workflows can separate the requester from the approver where policy supports it. Verify independence of roles in practice.
Place the control layer based on target-system proximity, network design, and operational requirements in physical and virtual environments.
Select the connection model for each system based on compatibility, protocol, and the available recording and command controls.
Route approved requests through a defined path to servers, applications, or databases, and review direct routes that could bypass the control layer.
Govern the use of privileged accounts and tie access to the target system, task, and required privileges.
Manage request, approval, and access-duration rules centrally to keep access conditions consistent across integrated systems.
Limit users to the resources and permissions required for their tasks instead of granting broader privileges.
Require an independent authentication factor before opening a sensitive administrative path, subject to policy and integration.
Use the enterprise identity provider where integrated, while retaining approvals and step-up verification for sensitive tasks.
Associate privileged account activity with the person who requested access to make accountability easier to trace.
Govern how administrator accounts are created, how privileges change, and when access is revoked.
Apply consistent rules across in-scope systems and keep exceptions explicit and reviewable.
Restrict the use of sensitive passwords and accounts to integrated paths rather than allowing uncontrolled sharing.
Verify identity and entitlement before opening a path, and review direct paths that could bypass PAM.
Allow or block commands on supported channels according to the task and policy.
Constrain each session to its approved privileges and systems to reduce opportunities for lateral movement.
Govern how credentials are used and shared, and define who may access them and how that access is reviewed.
Combine verification, approval, privilege restrictions, and session review as supported by the integration.
Use PAM alongside system hardening, segmentation, and monitoring, not as a replacement for them.
Link requests, approvals, and access to identity, time, and system for events the deployment can capture.
Keep a reviewable record of administrative sessions on supported protocols and channels.
Review unusual sign-in times or privilege use before classifying the activity as an incident.
Collect in-scope account activity and approval evidence to review what happened and who approved it.
Where supported, identify the individual behind a shared account by linking the session to the requester.
Review granted privileges and decide what to retain or revoke based on business need.
Prepare a sample linking an approved request to a session record to demonstrate how the control operated.
Inventory sensitive accounts and govern their use from one interface for integrated systems.
Manage approved access rules centrally and review exceptions for each target system.
Apply consistent access policy to integrated systems while respecting environment isolation and connectivity boundaries.
Bring account, role, and target system into one workflow to make permissions easier to grant and review.
Automate repeatable tasks such as provisioning or revocation where target systems support it.
Route requests to the appropriate approver and tie the decision to granting or denying access.
Unify administrative access management for integrated systems while accounting for protocol-specific capabilities.
Evaluate connections to on-premises systems and cloud services, including control-plane placement and ownership.
Keep access rules consistent across environments while maintaining distinct trust boundaries and administration paths.
For each integration, identify the target, protocol, and available control and recording functions before rollout.
Integrate in-scope application administration paths and define roles and what each application can log.
Restrict network-device administration to the paths and commands the integration supports.
Identify servers, databases, and critical assets whose access requires approval or recording.
Restrict administrative access to integrated cloud resources and review provider and customer responsibilities.
Test integration with virtual environments and identify where components run and how operators reach assets.
Bring requests, approvals, session controls, and reviews together rather than running them as separate processes.
Reduce manual coordination around requests and approvals with a clear, reviewable workflow.
Automate recurring account administration tasks while keeping exceptions subject to human review.
Route the request to the appropriate approver with the target system, task, and requested access duration.
Allow users to initiate authorized actions themselves within defined limits and approval rules.
Provide one path for requesting access and tracking approval instead of using separate channels.
Standardize approval rules, decision ownership, and review records for administrative accounts.
Prepare request, approval, and usage records as evidence for audit review.
Map organizational policy to privileged access settings and test allowed and denied cases.
Use privilege restrictions and monitoring to support control implementation and evidence, not as a compliance certification.
Retain request, approval, and usage events with identifiers that support correlation during an investigation.
Apply consistent grant and revocation conditions to in-scope systems and review exceptions as risks change.
Review accounts, privileges, and session records periodically to confirm that operational need still exists.
Place control components according to asset proximity and connectivity requirements in physical and virtual environments.
Test the administration path in the virtual environment without bypassing isolation or network controls.
Keep access decisions and policies in a central management layer, separated from target assets where appropriate.
Confirm support for each asset type and protocol before enabling access controls or session recording.
The technology is based on the application of centralized access policies to control sensitive accounts and determine the permitted privileges for each user or system.
Multi-factor authentication technology uses to reduce the risk of theft of credentials and unauthorized access.
Centrally isolates and manages sensitive administrative accounts to restrict unauthorized use of elevated privileges.
All activities and sessions related to sensitive accounts are recorded, providing the possibilities of monitoring and analysis of user behavior and administrative processes.
Administrative session recording lets security teams trace actions and investigate security events later.
Restricting powers and preventing the execution of unauthorized commands helps to reduce the transmission of attacks between systems within the network.
The technology provides a standard platform for the management of sensitive accounts, security policies, applications and devices from a central point.
The technology automates account management processes, policy implementation and reduces manual interference in security processes.
The technology supports integration with cloud, local and virtual environments within a uniform framework for identity and access management.
The technology provides detailed records of administrative activities that help in security audit, investigations, and support compliance and governance requirements.
An assessment can include on-premises, cloud or hybrid environments, applications, databases, and IT or OT systems in scope. Before deployment, confirm the target systems, protocols, identity integrations, recording retention and who can review the records.
Illustrative ways to support control implementation. An area may have more than one example; each row is not necessarily a separate official control.
| Domain or control | How it supports implementation | Application |
|---|---|---|
| Identity and access management | Link identity to privileged accounts and enforce MFA and least privilege based on policy and the impact of authentication failure or bypass. | Applied |
| Remote access management | Restrict remote administration to approved systems and times, and monitor sessions on supported channels. | Applied |
| Logging and monitoring | Tie session and administrative activity records to identity, time, and system. These records do not replace monitoring logs from other assets. | Applied |
| System and asset protection | Restrict administrative accounts and credentials to reduce exposure. Endpoint protection and system hardening remain separate controls. | Applied |
| Cybersecurity risk management | Time-bound access and limited privileges reduce misuse opportunities and provide evidence for risk and control assessments. | Applied |
| Cybersecurity governance | Standardize access requests, approvals, and reviews while leaving policy ownership and oversight with the organization. | Applied |
| Compliance and audit | Link approvals to activity records to prepare reviewable evidence without treating the existence of logs as proof of compliance. | Applied |
| Data protection | Protect administrative credentials and constrain their use. PAM alone does not classify or encrypt business data or govern all data handling. | Applied |
| Account and privilege management | Inventory administrative accounts, govern their lifecycle, and separate requesters from approvers where the workflow supports it. | Applied |
| Security monitoring and analysis | Supply privileged-access timing and behavior signals for correlation with other monitoring logs and alerts. | Applied |
| Operational continuity | Reduce opportunities to misuse critical-system accounts. Recovery plans, backups, and restore testing remain separate. | Applied |
| Change management | Associate administrative access with an approved change window and record without replacing change assessment, approval, or rollback. | Applied |
| Domain or control | How it supports implementation | Application |
|---|---|---|
| Security governance | Manage privileged access policies centrally and record decisions for review within the organization's governance structure. Related capability: Central Management of Security Policy | Applied |
| Identity and access management | Restrict access to sensitive systems to business needs and tie authorization decisions to a known identity. Related capability: Identity and access management | Applied |
| Privilege and entitlement management | Constrain allocation and use of privileged accounts to approved systems, tasks, and durations, and review usage. Related capability: Accounting and High Authority Management (PAM) | Applied |
| Remote access | Integrate MFA with remote administration and monitor sessions on supported channels. Related capability: multi-factor authentication and monitoring of sessions | Applied |
| Non-personal account protection | Restrict and monitor shared or non-personal accounts and attribute use to an individual where the path supports it. Related capability: Monitoring of Joint Accounts | Applied |
| Credential protection | Protect privileged passwords and manage use and rotation under policy and integration capabilities. Related capability: Protecting Sensitive Data | Applied |
| Event logging and records | Record requests, approvals, fulfillment or revocation, and associate session events with the account and system. Related capability: Activity logging and session recording | Applied |
| Security monitoring | Supply privileged-user activity signals to the monitoring team for correlation with other event sources. Related capability: Monitoring the user behavior. | Applied |
| Compliance and auditing | Provide records to trace approvals and usage during review while effectiveness testing and assessment remain with the organization. Related capability: Inspection records | Applied |
| Data protection | Reduce unauthorized administrative access to sensitive-data resources without replacing encryption or data loss prevention. Related capability: Strict control of powers | Applied |
| System protection | Limit administrative privileges or unauthorized commands on supported channels alongside other system safeguards. Related capability: Prohibition of the implementation of unauthorized orders | Applied |
| Infrastructure protection | Govern administrative access to integrated servers, databases, and applications; network and hardening controls remain separate. Related capability: Management of access to systems and devices | Applied |
| Risk management | Reduce standing or shared privilege exposure and provide input to access risk assessments. Related capability: Control of Sensitive Accounts | Applied |
| Access-related operational weaknesses | Address weak controls around open or shared accounts and poor traceability. PAM does not scan for or patch software vulnerabilities. Related capability: Restriction of privileges and monitoring of use | Applied |
| Operational security | Standardize day-to-day administration and automate requests and approvals on covered paths within broader operating procedures. Related capability: Automated Account Management and Policy | Applied |
| Third-party security | Give an approved external party time-bound, scoped administrative access and review its use. This does not replace supplier assessment. Related capability: Access Management for External and Sensitive Accounts | Applied |
| Cloud security | Govern privileged access to integrated cloud services while provider responsibilities, customer responsibilities, and configuration safeguards remain separate. Related capability: Supporting cloud and hybrid environments | Applied |
| Critical environment protection | Limit privileged accounts in critical environments, verify identity, and monitor sessions according to risk and integration capabilities. Related capability: Protection of administrative accounts for critical systems | Applied |
| Sensitive financial system protection | Control financial-system administration centrally and record sessions on integrated channels without replacing transaction controls. Related capability: Privileged access management and session recording | Applied |
| Business continuity | Reduce the impact of sensitive-account misuse without replacing continuity plans, disaster recovery, or restore testing. Related capability: Reduce the risk of abuse of privileges | Applied |
| Periodic review | Review privileged accounts, permissions, exceptions, and activity with system owners to decide what to retain or revoke. Related capability: Revision of powers and activities records | Applied |
Evaluate these examples against the facility level and assets in scope. They do not authorize IT/OT connectivity or component installation on operational assets without assessment.
| Domain or control | How it supports implementation | Application |
|---|---|---|
| Visibility and monitoring | Record and monitor administrative sessions on covered channels and forward events to monitoring where integrated. | Applied |
| Access control | Limit the privileged account, system, and duration. Exceptional remote access requires prior justification and risk assessment, with an encrypted channel, authentication, monitoring, and recording as required. | Applied |
| Unusual activity detection | Surface unusual privilege-use patterns for review and correlate with other OT signals before classifying an incident. | Applied |
| IT and OT connectivity management | Govern administrator access on integrated IT/OT paths without replacing network segmentation or inter-zone communications controls. | Applied |
| Industrial environment protection | Restrict administrative account use on supported operational assets without implying broad protection for industrial control systems. | Applied |
| Sensitive asset management | Associate accounts with covered operational systems and devices to clarify access scope. Asset inventory and classification remain separate. | Applied |
| Incident response | Supply recordings, approvals, and account-use context during investigation without replacing containment or escalation. | Applied |
| Security governance support | Standardize privileged access rules and document exceptions for review with operational asset owners. | Applied |
| Credential protection | Constrain use of operational-asset credentials and store them through an approved, supported secure mechanism. | Applied |
| Critical systems monitoring | Review administrative activities on covered channels and supply their context to monitoring. This does not cover all operations on critical systems. | Applied |
| Sensitive privilege separation | Separate privileges by task and apply dual approval to elevation or sensitive actions where supported by policy and integration. | Applied |
| Shared account management | Attribute shared-account use to the requester and recorded session where that association is supported. | Applied |
| Industrial compliance support | Prepare access records and reports for the operational facility's review scope without treating them as a compliance decision. | Applied |
| Operational risk reduction | Limit privileges and duration to reduce misuse impact and test changes on operational paths before wider deployment. | Applied |
| Domain or control | How it supports implementation | Application |
|---|---|---|
| Centralized authorization, least privilege and segregation of duties | When integrated with enterprise IAM, PAM can scope privileged access to the individual and task and separate the requester from the approver. | Applied |
| Multi-factor authentication for users with privileged accounts | Enforce MFA in the privileged access workflow when a supported integration is available and configured. | Applied |
| Logging and monitoring privileged account activity | PAM provides activity logs on supported channels for monitoring through the organization's procedures or integrations. Session recording alone does not demonstrate monitoring. | Applied |
“Applied” describes the capability in the illustrative example, not an implementation or compliance status for the customer.
Decision questions
Define the target, task, duration and approver. Apply a policy-based workflow and record sessions on supported channels where required.
PAM governs privileged access to accounts and systems. EPM governs privilege elevation for users and applications on endpoints.
EPM
Control privilege elevation for users and applications on endpoints.
Explore solutionPasswordless
Evaluate passwordless sign-in methods as part of your identity strategy.
Explore solutionCIAM
Govern how customers, partners, and external users access digital services.
Explore solutionMFA
Add a verification step to privileged access requests where the integration supports it.
Explore solutionReady for the next step?
Identify gaps and prepare evidence early. Share your priority systems and accounts so we can review your access workflows and audit evidence needs together.
