Privileged Access Control Review Workbook

Tests whether privileged access controls operate as the standard requires, system by system.

Available soon

Format: Excel
Size: 77 KB
Length: 13 sheets
Version: 2.0
Updated: 1 Oct 2026

Follow this documentFree account. We can email you when it changes.

What changed

2.01 Oct 2026
Rewritten to the depth of the other CISO Times packs: a scope of every system with its review interval and next review due; the thirteen tests for each system with evidence and a record check; a test guide with the evidence to keep and the route without a PAM platform; findings and actions with statuses against the as-at date; and a summary of results by system with a signature block.
1.01 Oct 2026
Published.

Changes across this pack

Preview

The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.

Instructions

How to use this workbook

Step	What to do
1	Set the review's details at the top of the Review summary sheet: its ID, the date, the as-at date and the date the standard was approved. The EXAMPLE uses CR-2026-01 of 2026-09-24, as at 2026-09-30.
2	On Review scope, list every system with its tier from the Administrative Tier Model & Separation Matrix, its owner and the suppliers with access. The next review due calculates from the last review, or from the standard's approval for a system never reviewed. Mark the systems in this review and say why each was chosen: Tier 0 first, then systems with supplier access or recent findings.
3	The reviewer is the Session reviewer, who holds no administrator rights in the tier reviewed (PA-09, SOD-IT-02). The system owner provides the exports; the administrators answer questions but do not mark their own work.
4	On Control review, enter the 13 tests for each system in the review. Read each test's criterion and the Test guide, collect the evidence, and record Pass, Fail or Not applicable. A Fail or Not applicable needs its evidence or reason; a Fail needs a finding.
5	Raise each finding on Findings with the rules it breaks and the account concerned. One finding can explain several failed tests. Agree each action on Actions with an owner and a due date; the finding closes when every action is done.
6	Read the Review summary: results by system, findings open and closed, and the actions due next. The Session reviewer and the Head of Information Security sign it, and each system owner accepts the result for their system.
7	Take the findings to the next privileged access review (P07) and the monthly report in the Privileged Access Metrics Dashboard. A departure from the standard that will not be fixed becomes a P02 exception (PA-18).
8	To clear the EXAMPLE, delete the contents of the Example column and of every yellow cell on the working sheets. Keep the tests, the guide and the formulas.

Legend

Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.

EXAMPLE

Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval.

EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, as at 30 Sep 2026. Its first control review, CR-2026-01 on 24 Sep 2026, covered PS-01, PS-02, PS-06: the two Tier 0 identity systems, and the warehouse system because its supplier (P06 SUP-010) has remote support access and is not yet assessed. 5 tests failed. Four trace to one service account nobody owned (PF-01), one to a break-glass use nobody reviewed (PF-02). PF-03, a tier breach, came from the first weekly session review and is tracked here with the others.

Adapting for a small organisation: review the Tier 0 systems every six months and the rest once a year, as PA-16 sets, but a dozen tests on three systems is a day's work. Where nobody without administrator rights can do it, ask a peer from another organisation or the internal auditor.

Adapting for a regulated entity (NIS2, DORA): the review is the record that privileged access is reviewed at planned intervals and the results documented (Implementing Regulation (EU) 2024/2690 Annex 11.3.3). Keep the evidence with each review.

Adapting where a service provider runs your IT: the provider supplies the exports and the logs; it does not mark the tests. Put its evidence in the Evidence column and its failures on your Findings sheet, owned by your people.

Review scope

Every system with its tier (PA-13) and how often its controls are tested (PA-16). Yellow columns are inputs; a system never reviewed is due the interval after the standard was approved.

Example	System ID	System	Tier	System owner	Suppliers with access	Test every (months, calc)	Last control review	Next review due (calc)	Schedule (calc)	In this review	Why it was chosen
EXAMPLE	PS-01	Directory and its administrator groups	0	Head of IT	SUP-001, SUP-006	6	24 Sep 2026	24 Mar 2027	Scheduled	Yes	The two Tier 0 identity systems
EXAMPLE	PS-02	Cloud identity tenant (email and office, P06 SUP-005)	0	Head of IT	SUP-005	6	24 Sep 2026	24 Mar 2027	Scheduled	Yes	The two Tier 0 identity systems
EXAMPLE	PS-03	Backup service console (P06 SUP-011)	0	Head of IT	SUP-011	6		18 Mar 2027	Scheduled	No
EXAMPLE	PS-04	Endpoint protection and device management consoles	0	Head of IT	SUP-006	6		18 Mar 2027	Scheduled	No
EXAMPLE	PS-05	ERP (hosted, P06 SUP-004; P07 SYS-01)	1	Chief Financial Officer	SUP-004	12		18 Sep 2027	Scheduled	No
EXAMPLE	PS-06	Warehouse management system servers (P07 SYS-02)	1	Head of Logistics	SUP-010	12	24 Sep 2026	24 Sep 2027	Scheduled	Yes	The warehouse system because its supplier (P06 SUP-010) has remote support access and is not yet assessed
EXAMPLE	PS-07	Online ordering admin console (P07 SYS-04)	1	Chief Operating Officer	None	12		18 Sep 2027	Scheduled	No
EXAMPLE	PS-08	File and application servers, and the firewalls	1	Head of IT	SUP-001	12		18 Sep 2027	Scheduled	No
EXAMPLE	PS-09	Office PCs and laptops	2	Head of IT	SUP-001	12		18 Sep 2027	Scheduled	No

Control review

The 13 tests for each system in the review, by someone with no administrator rights in its tier (PA-09). Look at the evidence, not at what people say.

Example	Review ID	System ID	Tier (calc)	Test ID	Rule (calc)	What to test, and when it passes	Result	Evidence, or the reason for a Fail or Not applicable	Finding	Record check (calc)
EXAMPLE	CR-2026-01	PS-01	0	CT-01	PA-01	Export every account with privileged rights on the system and match it to the inventory. Pass if every one is there with an owner.	Pass	The dated export of privileged accounts and the inventory extract it was matched to		Recorded
EXAMPLE	CR-2026-01	PS-01	0	CT-02	PA-02	Pass if every administrator on the system uses a named administrator account of the system's tier.	Pass	The list of administrators who worked on the system, with the account each used		Recorded
EXAMPLE	CR-2026-01	PS-01	0	CT-03	PA-03	Pass if no daily account holds administrator rights on the system.	Pass	Membership of the system's administrator groups, compared with the list of daily accounts		Recorded
EXAMPLE	CR-2026-01	PS-01	0	CT-04	PA-05	Check the sign-in policy and the last 30 days of administrator sign-ins. Pass if every one used an accepted method, or the recorded exception.	Pass	The sign-in policy, and the last 30 days of administrator sign-ins with the method used		Recorded
EXAMPLE	CR-2026-01	PS-01	0	CT-05	PA-06	Pass if no human account holds standing rights outside the allowed cases, and every elevation in the last 30 days ended within the tier's maximum.	Pass	The standing role and group assignments, and the elevations of the last 30 days with start and end		Recorded
EXAMPLE	CR-2026-01	PS-01	0	CT-06	PA-07	Sample [[10]] elevations. Pass if each has an approval by someone other than the requester.	Pass	The sample of elevations, each with its ticket and approver		Recorded
EXAMPLE	CR-2026-01	PS-01	0	CT-07	PA-08	Pass if privileged events reach the central log store and a test event was found there.	Pass	The test event and the search that found it in the central log store		Recorded
EXAMPLE	CR-2026-01	PS-01	0	CT-08	PA-09	Pass if every session review due in the last quarter was done on time, by someone without rights in the tier.	Pass	The session review records of the last quarter, with due and done dates and the reviewer		Recorded
EXAMPLE	CR-2026-01	PS-01	0	CT-09	PA-10	Pass if every shared, service and break-glass credential on the system is in the vault or managed, and within its rotation period.	Pass	The vault entries and the last change date of each shared, service and break-glass credential		Recorded
EXAMPLE	CR-2026-01	PS-01	0	CT-10	PA-11	Pass if every service account has an owner and is denied interactive logon, and none signed in interactively in the last 30 days.	Pass	Each service account's owner, the logon policy that denies it, and 30 days of its sign-ins		Recorded
EXAMPLE	CR-2026-01	PS-01	0	CT-11	PA-12	For the identity systems: pass if every break-glass check (A05) passes.	Pass	The Break-Glass Account Control Checklist, completed after the last test		Recorded
EXAMPLE	CR-2026-01	PS-01	0	CT-12	PA-13	Pass if the system's tier is recorded and no account of another tier signed in to it in the last 30 days.	Pass	The system's tier in the inventory, and 30 days of sign-ins by accounts of other tiers		Recorded
EXAMPLE	CR-2026-01	PS-01	0	CT-13	PA-15	Pass if every supplier account is named, enabled only for approved windows and logged.	Not applicable	No supplier administrator account on the system		Recorded
EXAMPLE	CR-2026-01	PS-02	0	CT-01	PA-01	Export every account with privileged rights on the system and match it to the inventory. Pass if every one is there with an owner.	Pass	The dated export of privileged accounts and the inventory extract it was matched to		Recorded
EXAMPLE	CR-2026-01	PS-02	0	CT-02	PA-02	Pass if every administrator on the system uses a named administrator account of the system's tier.	Pass	The list of administrators who worked on the system, with the account each used		Recorded
EXAMPLE	CR-2026-01	PS-02	0	CT-03	PA-03	Pass if no daily account holds administrator rights on the system.	Pass	Membership of the system's administrator groups, compared with the list of daily accounts		Recorded
EXAMPLE	CR-2026-01	PS-02	0	CT-04	PA-05	Check the sign-in policy and the last 30 days of administrator sign-ins. Pass if every one used an accepted method, or the recorded exception.	Pass	The sign-in policy, and the last 30 days of administrator sign-ins with the method used		Recorded
EXAMPLE	CR-2026-01	PS-02	0	CT-05	PA-06	Pass if no human account holds standing rights outside the allowed cases, and every elevation in the last 30 days ended within the tier's maximum.	Pass	The standing role and group assignments, and the elevations of the last 30 days with start and end		Recorded
EXAMPLE	CR-2026-01	PS-02	0	CT-06	PA-07	Sample [[10]] elevations. Pass if each has an approval by someone other than the requester.	Pass	The sample of elevations, each with its ticket and approver		Recorded
EXAMPLE	CR-2026-01	PS-02	0	CT-07	PA-08	Pass if privileged events reach the central log store and a test event was found there.	Pass	The test event and the search that found it in the central log store		Recorded
EXAMPLE	CR-2026-01	PS-02	0	CT-08	PA-09	Pass if every session review due in the last quarter was done on time, by someone without rights in the tier.	Pass	The session review records of the last quarter, with due and done dates and the reviewer		Recorded
EXAMPLE	CR-2026-01	PS-02	0	CT-09	PA-10	Pass if every shared, service and break-glass credential on the system is in the vault or managed, and within its rotation period.	Pass	The vault entries and the last change date of each shared, service and break-glass credential		Recorded
EXAMPLE	CR-2026-01	PS-02	0	CT-10	PA-11	Pass if every service account has an owner and is denied interactive logon, and none signed in interactively in the last 30 days.	Pass	Each service account's owner, the logon policy that denies it, and 30 days of its sign-ins		Recorded
EXAMPLE	CR-2026-01	PS-02	0	CT-11	PA-12	For the identity systems: pass if every break-glass check (A05) passes.	Fail	BG-08 failed for bg-cloud-01: the use BGU-2026-01 on 5 Sep 2026 was not reviewed until 25 Sep 2026	PF-02	Finding PF-02
EXAMPLE	CR-2026-01	PS-02	0	CT-12	PA-13	Pass if the system's tier is recorded and no account of another tier signed in to it in the last 30 days.	Pass	The system's tier in the inventory, and 30 days of sign-ins by accounts of other tiers		Recorded
EXAMPLE	CR-2026-01	PS-02	0	CT-13	PA-15	Pass if every supplier account is named, enabled only for approved windows and logged.	Not applicable	No supplier administrator account on the system		Recorded
EXAMPLE	CR-2026-01	PS-06	1	CT-01	PA-01	Export every account with privileged rights on the system and match it to the inventory. Pass if every one is there with an owner.	Fail	svc-wms-db has local administrator rights on both servers, no owner, and was not in the inventory	PF-01	Finding PF-01
EXAMPLE	CR-2026-01	PS-06	1	CT-02	PA-02	Pass if every administrator on the system uses a named administrator account of the system's tier.	Pass	The list of administrators who worked on the system, with the account each used		Recorded
EXAMPLE	CR-2026-01	PS-06	1	CT-03	PA-03	Pass if no daily account holds administrator rights on the system.	Pass	Membership of the system's administrator groups, compared with the list of daily accounts		Recorded
EXAMPLE	CR-2026-01	PS-06	1	CT-04	PA-05	Check the sign-in policy and the last 30 days of administrator sign-ins. Pass if every one used an accepted method, or the recorded exception.	Pass	The sign-in policy, and the last 30 days of administrator sign-ins with the method used		Recorded
EXAMPLE	CR-2026-01	PS-06	1	CT-05	PA-06	Pass if no human account holds standing rights outside the allowed cases, and every elevation in the last 30 days ended within the tier's maximum.	Pass	The standing role and group assignments, and the elevations of the last 30 days with start and end		Recorded
EXAMPLE	CR-2026-01	PS-06	1	CT-06	PA-07	Sample [[10]] elevations. Pass if each has an approval by someone other than the requester.	Pass	The sample of elevations, each with its ticket and approver		Recorded
EXAMPLE	CR-2026-01	PS-06	1	CT-07	PA-08	Pass if privileged events reach the central log store and a test event was found there.	Pass	The test event and the search that found it in the central log store		Recorded
EXAMPLE	CR-2026-01	PS-06	1	CT-08	PA-09	Pass if every session review due in the last quarter was done on time, by someone without rights in the tier.	Pass	The session review records of the last quarter, with due and done dates and the reviewer		Recorded
EXAMPLE	CR-2026-01	PS-06	1	CT-09	PA-10	Pass if every shared, service and break-glass credential on the system is in the vault or managed, and within its rotation period.	Fail	svc-wms-db's password unchanged since 14 Mar 2019, kept in the supplier's support notes; not in the vault	PF-01	Finding PF-01
EXAMPLE	CR-2026-01	PS-06	1	CT-10	PA-11	Pass if every service account has an owner and is denied interactive logon, and none signed in interactively in the last 30 days.	Fail	svc-wms-db is allowed interactive logon; it was last used interactively on 16 Sep 2026	PF-01	Finding PF-01
EXAMPLE	CR-2026-01	PS-06	1	CT-11	PA-12	For the identity systems: pass if every break-glass check (A05) passes.	Not applicable	Not an identity system: CT-11 applies to the systems that hold break-glass accounts		Recorded
EXAMPLE	CR-2026-01	PS-06	1	CT-12	PA-13	Pass if the system's tier is recorded and no account of another tier signed in to it in the last 30 days.	Pass	The system's tier in the inventory, and 30 days of sign-ins by accounts of other tiers		Recorded
EXAMPLE	CR-2026-01	PS-06	1	CT-13	PA-15	Pass if every supplier account is named, enabled only for approved windows and logged.	Fail	The supplier's support staff sign in with svc-wms-db through the remote support tool, not with named accounts	PF-01	Finding PF-01

Test guide

Test guide: the rules, the evidence, and how to test without a PAM platform

For each test: the rule it checks, quoted from the Privileged Access Standard, what passes, the evidence to keep with the review, and how to collect it with tools the organisation already has. The test IDs and rules here feed the Control review sheet. Change a rule in the standard, never here.

Test	Rule	The rule, in full	What to test, and when it passes	Evidence to keep	Without a PAM platform
CT-01	PA-01	Every privileged account, human and non-human, must be in the inventory with a named owner, its tier, its purpose, where its credential is kept and when it was last changed. An account found that is not in the inventory is disabled unless an owner claims it within [[5]] working days. For a service account, assign an interim owner within that window to control its use while dependencies are checked under PA-11; the 30-day limit is not permission to leave it uncontrolled.	Export every account with privileged rights on the system and match it to the inventory. Pass if every one is there with an owner.	The dated export of privileged accounts and the inventory extract it was matched to	Export the members of each administrator group and role from the system itself, and compare the list with the Privileged & Service Account Inventory.
CT-02	PA-02	Administration must be done only from a separate administrator account, named for one person and one tier. Administrator accounts are never shared, except the built-in and break-glass accounts held in the vault.	Pass if every administrator on the system uses a named administrator account of the system's tier.	The list of administrators who worked on the system, with the account each used	Separate administrator accounts: Create a second account per person per tier in the directory, named by tier (for example a0-, a1-, a2-). Give it no mailbox and no office licence.
CT-03	PA-03	A daily account must hold no administrator rights anywhere, including local administrator rights on the person's own device. Support uses the local administrator password solution instead.	Pass if no daily account holds administrator rights on the system.	Membership of the system's administrator groups, compared with the list of daily accounts	No administrator rights on daily accounts: Remove daily accounts from every local and directory administrator group through device management or group policy, and let support use the local administrator password solution.
CT-04	PA-05	Every privileged sign-in must use a phishing-resistant method: a security key, a passkey on a managed device, or a certificate. Where a system can use neither the organisation's single sign-on nor such a method, it uses the strongest method it offers, recorded in the inventory with the date it will move.	Check the sign-in policy and the last 30 days of administrator sign-ins. Pass if every one used an accepted method, or the recorded exception.	The sign-in policy, and the last 30 days of administrator sign-ins with the method used	Phishing-resistant sign-in: Register security keys or passkeys in the identity provider the organisation already has, and require them for administrator accounts by sign-in policy.
CT-05	PA-06	Privileged rights in Tier 0 and Tier 1 must be just-in-time: eligible, activated for one task and ended after no more than [[4]] hours in Tier 0 and [[8]] hours in Tier 1. Standing rights are allowed only for break-glass and service accounts, Tier 2 support on separate Tier 2 accounts, read-only monitoring, and application roles the application cannot assign for a time, each recorded in the inventory.	Pass if no human account holds standing rights outside the allowed cases, and every elevation in the last 30 days ended within the tier's maximum.	The standing role and group assignments, and the elevations of the last 30 days with start and end	Time-limited elevation: Use the directory's time-limited group membership, or the cloud tenant's time-limited role assignment where the licence includes it. Otherwise add the right by ticket with an end time, and run a scheduled task that removes it and a daily report that lists any right older than its ticket.
CT-06	PA-07	Every elevation and every new privileged account must be approved as the approvals table sets, by someone other than the person who will use it. The segregation-of-duties conflicts of the P02 matrix apply.	Sample [[10]] elevations. Pass if each has an approval by someone other than the requester.	The sample of elevations, each with its ticket and approver	Take the elevations from the directory or tenant audit log and match each to its ticket and approver in the ticket system.
CT-07	PA-08	Every privileged sign-in, elevation, change to a privileged group or role, and vault opening must be logged to a store administrators cannot change or delete, and kept for at least [[12]] months.	Pass if privileged events reach the central log store and a test event was found there.	The test event and the search that found it in the central log store	Logging: Forward the directory's security events (for Windows: 4624 sign-in, 4672 special privileges assigned, 4728, 4732 and 4756 group membership added), the cloud tenant's audit and sign-in logs and servers' administrator command logs to the central log store the monitoring provider keeps.
CT-08	PA-09	Privileged activity must be reviewed at the cadence the session review table sets, by someone with no administrator rights in that tier. Anything unexplained is followed up and recorded.	Pass if every session review due in the last quarter was done on time, by someone without rights in the tier.	The session review records of the last quarter, with due and done dates and the reviewer	Session review: A saved search per tier over the forwarded logs, run by the reviewer at the cadence set, compared with the ticket list. Supplier sessions are recorded by the remote support tool where it can.
CT-09	PA-10	Shared, service and break-glass credentials must be kept in the vault or managed by the platform, and changed as the rotation table sets, after every use where it says so, and at once on suspicion of compromise.	Pass if every shared, service and break-glass credential on the system is in the vault or managed, and within its rotation period.	The vault entries and the last change date of each shared, service and break-glass credential	Unique local administrator passwords: Turn on the operating system's local administrator password solution (Windows LAPS is built in): a different password on every device, changed automatically and after use, with every opening logged.
CT-10	PA-11	Every service account must have a named owner, do one job with the least rights it needs, and be denied interactive logon. A service account with no owner found within [[30]] days is disabled, and deleted [[90]] days after that if nothing breaks.	Pass if every service account has an owner and is denied interactive logon, and none signed in interactively in the last 30 days.	Each service account's owner, the logon policy that denies it, and 30 days of its sign-ins	Service accounts: Use the platform's managed service accounts or managed identities, which change their own passwords; deny interactive and Remote Desktop logon to every other service account by group policy.
CT-11	PA-12	There must be [[2]] break-glass accounts for each cloud identity tenant and [[1]] for each on-premises directory, sealed in the safe, alerting on every sign-in and tested every [[3]] months. They are used only when the normal route is unavailable, and every use is declared, reviewed and followed by a credential change within [[1]] working day.	For the identity systems: pass if every break-glass check (A05) passes.	The Break-Glass Account Control Checklist, completed after the last test	The vault: The organisation's business password manager, in a shared vault open only to named administrators, with its access log kept. Break-glass credentials also go in the safe.
CT-12	PA-13	Every system must have a tier, and administrator accounts must follow the separation rules. An administrator account used outside its tier, or for email or browsing, is treated as a possible exposure of its credential.	Pass if the system's tier is recorded and no account of another tier signed in to it in the last 30 days.	The system's tier in the inventory, and 30 days of sign-ins by accounts of other tiers	Tier separation: Use group policy to deny sign-in by higher-tier administrator groups on lower-tier systems (console, Remote Desktop, batch and service logon), and add Tier 0 accounts to the directory's protected users group.
CT-13	PA-15	A supplier's staff must use named accounts, enabled only for the agreed window and logged; shared supplier accounts are not allowed. Where a supplier administers a system on its own platform, the contract clauses of P06 cover it (TP-07, CL-09).	Pass if every supplier account is named, enabled only for approved windows and logged.	The supplier accounts, their approved windows and the log of their sessions	Compare the supplier accounts' enabled periods with the access windows the system owner approved under the Privileged Access Request, Elevation & Revocation Procedure.

Results: Pass, Fail, Not applicable. Not applicable needs a reason: CT-11 applies only to the systems that hold break-glass accounts, CT-13 only where supplier accounts exist.

How often, and by whom

Rule	Requirement	Where this workbook applies it
PA-16	Privileged access must be reviewed every [[3]] months by the system owner and information security (P07 AR-02, AR-06), and the controls of this standard tested system by system at least once a year, and every [[6]] months for Tier 0.	Review scope: every [[6]] months for Tier 0 and [[12]] for the rest, with the next review due for each system.
SOD-IT-02	Privileged access is reviewed by the system owner and information security, never by the administrators who hold it (PA-16).	P02's two duties: Create or change user accounts and permissions; Review access rights (periodic access review).
SOD-IT-03	Privileged activity logs go to a store administrators cannot change, and sessions are reviewed by someone with no administrator rights in that tier (PA-08, PA-09).	P02's two duties: Administer a system with privileged access; Review a system's audit logs.
SOD-SO-01	Whoever can grant privileged access does not review it; elevation expires by itself (PA-06, PA-16).	P02's two duties: Grant privileged access; Review access rights (periodic access review).

Findings

One row per finding, from this review or from a session review. A finding closes when every action on the Actions sheet is done.

Example	Finding ID	Found on	Source	System ID	Account	Rules broken	Finding	Failed tests	Actions (calc)	Done (calc)	Status (calc)	Next action due (calc)
EXAMPLE	PF-01	24 Sep 2026	CR-2026-01	PS-06	svc-wms-db	PA-01, PA-10, PA-11, PA-15	The warehouse system's database service account had no owner and was not in the inventory. It could sign in interactively, its password had not changed since the system was installed on 14 Mar 2019, and the supplier's support staff used it to sign in through the remote support tool, most recently on 16 Sep 2026.	PS-06: CT-01, CT-09, CT-10, CT-13	5	1	Open	4 Oct 2026
EXAMPLE	PF-02	24 Sep 2026	CR-2026-01	PS-02	bg-cloud-01	PA-12	The break-glass use on 5 Sep 2026 was declared and the credential changed on time, but nobody reviewed the session: the Head of IT thought the provider would, and the provider thought the Head of IT would.	PS-02: CT-11	2	2	Closed
EXAMPLE	PF-03	28 Sep 2026	SR-2026-W39	PS-08	adm-pshah	PA-02, PA-13	One account held Tier 0 rights (Backup Operators) and Tier 1 rights (Server Admins). With the Tier 0 elevation active, it signed in to a Tier 1 file server, where the Tier 0 credential could have been captured.	None: found in SR-2026-W39	3	2	Open	28 Oct 2026

Actions

One row per action, with a named owner and a due date. Record the date it was done and what it found or changed; the status calculates against the as-at date.

Example	Finding	No.	Action	Owner	Due	Done on	Result	Status (calc)	Open, due (calc)
EXAMPLE	PF-01	1	Name an owner	Head of IT	25 Sep 2026	25 Sep 2026	IT Operations Manager	Done
EXAMPLE	PF-01	2	Give the supplier's two support engineers named accounts, enabled only for approved windows	IT Operations Manager	9 Oct 2026			Open	9 Oct 2026
EXAMPLE	PF-01	3	Change the password in the Sunday change window and put it in the vault	IT Operations Manager	4 Oct 2026			Open	4 Oct 2026
EXAMPLE	PF-01	4	Deny interactive and remote support logon to the account	IT Operations Manager	9 Oct 2026			Open	9 Oct 2026
EXAMPLE	PF-01	5	Take the finding into the supplier's assessment, with the access clause (P06 CL-09)	Information Security Manager	20 Oct 2026			Open	20 Oct 2026
EXAMPLE	PF-02	1	Review the session	Head of Information Security	25 Sep 2026	25 Sep 2026		Done
EXAMPLE	PF-02	2	Name the Head of Information Security as the reviewer of every use in the break-glass checklist	Head of IT	25 Sep 2026	25 Sep 2026		Done
EXAMPLE	PF-03	1	Change the account's password and end its sessions	Head of IT	28 Sep 2026	28 Sep 2026		Done
EXAMPLE	PF-03	2	Check FS-02 for signs of compromise	Information Security Manager	29 Sep 2026	29 Sep 2026	No sign of compromise	Done
EXAMPLE	PF-03	3	Split the account into a Tier 0 and a Tier 1 account, and deny Tier 0 groups sign-in on Tier 1 servers	Head of IT	28 Oct 2026			Open	28 Oct 2026

Review summary

Review summary and sign-off

The review's details, the results by system, the findings and actions, and the sign-off. Yellow cells are yours; everything else calculates.

The review

Item	Value	Note
Review ID	CR-2026-01
Review date	24 Sep 2026
As-at date	30 Sep 2026	EXAMPLE: the quarter end; action statuses are judged on it.
Standard approved on	18 Sep 2026	A system never reviewed is due one interval after this.
Months between tests, Tier 0 (PA-16)	6	[[6]] in the Privileged Access Standard.
Months between tests, Tier 1 and 2 (PA-16)	12	[[12]]: at least once a year.
Reviewer	Information Security Manager	Holds no administrator rights in the tiers reviewed (PA-09).

Results by system

System	Tier	Tests	Pass	Fail	Not applicable	Result
PS-01	0	13	12	0	1	Controls working
PS-02	0	13	11	1	1	Findings raised
PS-06	1	13	8	4	1	Findings raised

All systems in the review		39	31	5	3	0	Findings raised

Yellow: the System IDs in this review. Tests are counted for the Review ID above.

Findings and actions

Measure	Count	An overdue action goes to the next monthly report with its new date and the reason (PA-18).
Findings open	2
Findings closed	1
Actions	10
Actions done	5
Actions open, not yet due	5
Actions overdue	0
Next open action due	4 Oct 2026

Sign-off

Role	Name	Date	Signature or reference
Review carried out by (Session reviewer)	[[Name]]	[[YYYY-MM-DD]]	[[Reference]]
Reviewed by (Head of Information Security)	[[Name]]	[[YYYY-MM-DD]]	[[Reference]]
Result accepted by each system owner	[[Names, one per system]]	[[YYYY-MM-DD]]	[[Reference]]
Next review	[[Tier 0 within 6 months; others within 12]]	[[YYYY-MM-DD]]

Lists

Result	YesNo	Tiers
Pass	Yes	0
Fail	No	1
Not applicable		2

Definitions

Definitions

Term	Meaning in this workbook
Control review	A test of the standard's controls on one system at a time, by someone with no administrator rights in its tier, with evidence kept for each test (PA-16).
Control test	One of CT-01 to CT-13: a check of one rule on one system, with a pass criterion.
Pass	The evidence shows the system meets the test's criterion today.
Fail	The evidence shows it does not, or there is no evidence. Record what was found and the finding it raises.
Not applicable	The test cannot apply to the system, for example CT-11 on a system with no break-glass account. Record the reason.
Finding	What is wrong, the rules it breaks and the account or system concerned. One finding can explain several failed tests.
Action	A step that fixes a finding, with a named owner and a due date. A finding closes when all its actions are done.
Session review	A check, by someone other than the administrator, that privileged activity in a period matches approved tickets and the rules, with anything unexplained followed up (PA-09).
Tier	A group of systems that give the same level of control over the organisation. An administrator account belongs to one tier (A08).
Privileged account	Any account that holds privileged access, standing or when elevated: a named administrator account, a supplier's administrator account, an application administrator role, a service account, a shared or built-in administrator account, or a break-glass account.
Service account	An account used by software, not a person: to run a service, a scheduled task or an integration. It has a named owner and cannot sign in interactively (PA-11).
Tier breach	An administrator account used outside its tier, or for email or browsing. Treated as a possible exposure of that account's credential (PA-13).
(calc)	A column or cell the workbook calculates. Do not type or paste over it.
EXAMPLE	A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, as at 30 Sep 2026. Delete before use.

Framework References

Framework references

These references indicate relevance only and do not reproduce the text of any standard.

Framework	Reference	Supported by
ISO/IEC 27001:2022	Annex A 8.2 — Privileged access rights	Control review: each privileged access control tested system by system, with evidence
NIST CSF 2.0	PR.AA-05 — “Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties”	The whole workbook: privileged permissions reviewed against the standard, with findings tracked to closure
NIS2 — Directive (EU) 2022/2555	Article 21(2)(i) — “human resources security, access control policies and asset management”	The review as part of the access control policy's checks
NIS2 — Implementing Regulation (EU) 2024/2690	Article 1 — lays down the technical and methodological requirements of the Article 21(2) measures, and further specifies when an incident is significant, for DNS service providers, TLD name registries, cloud computing, data centre and content delivery network providers, managed service and managed security service providers, providers of online marketplaces, online search engines and social networking services platforms, and trust service providers	The Implementing Regulation binds only the digital providers its Article 1 names; for others it shows what the regulator expects
NIS2 — Implementing Regulation (EU) 2024/2690	Annex, point 11.3.3 — “The relevant entities shall review access rights of privileged accounts and system administration accounts at planned intervals and be modified based on organisational changes, and shall document the results of the review, including the necessary changes of access rights.”	Review scope and Review summary: privileged accounts reviewed at planned intervals, with the results and changes documented
DORA — Regulation (EU) 2022/2554	Article 9(4)(c) — policies that limit access to information and ICT assets to what is required for legitimate and approved functions, with controls that ensure sound administration of access rights	Control review: the controls that keep privileged access to what is required, tested (financial entities)
DORA — Delegated Regulation (EU) 2024/1774	Article 21(e) — account management: roles for granting, reviewing and revoking access; privileged access on a need-to-use basis; removal without undue delay; review at least every six months for systems supporting critical or important functions and at least yearly for others	Control review and Findings: privileged access rights reviewed and corrected (financial entities)
ISO/IEC 27001:2022	Annex A 5.18 — Access rights	Findings and Actions: access rights corrected where the review finds them wrong

ISO/IEC 27001 references name the clause or control this document relates to. They do not say that meeting it meets any other framework's requirement.