ISO 27001 A.8.2: Privileged access rights

Write a privileged access management (PAM) policy that spells out who qualifies for elevated access, under what conditions, and what controls apply. Keep the number of privileged accounts to an absolute minimum.

Deploy a PAM solution. A good PAM tool gives you credential vaulting, just-in-time access grants, session recording and monitoring, automated credential rotation, and break-glass procedures for emergencies. This is one of those investments that pays for itself in audit findings avoided.

Separate privileged from standard accounts. Every admin should have a regular account for email, browsing, and daily work, and a separate privileged account used only for administrative tasks. This limits exposure to phishing and malware - if the daily account gets compromised, the attacker still does not have admin rights.

Enforce strong authentication on all privileged accounts. MFA is mandatory. For your most critical systems, use phishing-resistant MFA like FIDO2 hardware keys. Add step-up authentication for especially sensitive operations.

Move to just-in-time (JIT) access wherever you can. Instead of permanent standing privileges, grant elevated permissions only when needed, for a limited duration, with justification and approval required. Auto-revoke when the window expires.

Monitor and audit everything privileged accounts do. Log all activity with enough detail for forensic investigation. Set up alerts for anomalies - unusual access times, unexpected locations, excessive privilege use. Review logs regularly and run periodic access reviews to confirm every privileged account is still justified.