What is privileged access
Privilege includes administrators, cloud roles, database owners, service identities, emergency accounts, security tools, automation, and any access that can materially change systems or controls.
Core practices
- Separate normal and privileged identities
- Use strong authentication and controlled workstations where appropriate
- Grant access just in time and for limited duration
- Vault, rotate, and monitor credentials and secrets
- Record and review high-risk activity
- Maintain controlled emergency access
- Review roles, assignments, and unused privilege
Beyond administrator accounts
Service accounts and machine identities can hold broad, persistent access. They require ownership, purpose, rotation, monitoring, and retirement just as human accounts do.
Measure risk
Track standing privilege, orphaned access, shared credentials, time-bound coverage, emergency use, failed rotation, privileged paths, and high-impact actions.
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: