Section · 7 pages
Privileged access
The accounts that can change everything deserve the most care. These pages cover who should hold privilege, for how long, how it is granted and watched, and how machines get credentials without leaving secrets lying around.
Privileged access Least privilege
Grant only the access a task needs, for people, admins and workloads alike. What SP 800-53 AC-6 and AC-5 actually ask for, and how to keep it true over time.
Privileged access Privileged accounts
Any account that can change who gets in, what they can do, or what gets logged. How to find them all, separate them from daily work and keep their credentials clean.
Privileged access Just-in-time access
Privilege that exists only while it is being used: requested, approved, time-bound and removed automatically. How it works and where it usually goes wrong.
Privileged access Break-glass accounts
The accounts you keep for when normal administration fails. What the standards say, what is only common practice, and how to keep them usable without making them a backdoor.
Privileged access Service accounts and secrets
Most identities are not people. How to give workloads unique, least-privilege identities, replace long-lived secrets with short-lived tokens, and manage the secrets that remain.
Privileged access Access reviews
Lifecycle events should change access as they happen; periodic reviews catch what they miss. How to run both so they find real problems rather than produce signatures.
Architecture Zero trust
Zero trust is a set of principles for deciding every access request on current evidence, not a product. What SP 800-207 actually says and what it means for identity.