Privileged Access Metrics Dashboard
Reports privileged account count, standing versus just-in-time access, rotation compliance and review completion.
Available soon
- Format
- Excel
- Size
- 70 KB
- Length
- 13 sheets
- Version
- 2.0
- Updated
Follow this documentFree account. We can email you when it changes.
What's inside
What changed
- 2.0
Rewritten to the depth of the other CISO Times packs: the seven headline measures with three months, target, tolerance, status in P11's words and direction; definitions and settings on a Metrics sheet; monthly values with their sources; the findings behind the measures with the next action due; and the reporting levels and PA-18.
- 1.0
Published.
Preview
The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.
Instructions
How to use this workbook
| Step | What to do |
|---|---|
| 1 | Type the report month (its last day) and the as-at date at the top of the Dashboard. Never use a formula that changes them. |
| 2 | Check the Metrics sheet: each measure's definition, unit, whether higher or lower is better, and the target and tolerance limit the security and IT leadership team agreed. A share is a number from 0 to 1. Leave the target blank for a measure reported without one, as PAM-01 is. |
| 3 | Each month, add one row per measure on Monthly Values: the month end, the value and, for a share, what it is out of. Take each from the source on the Sources sheet. Leave a measure out if it was not measured; never copy last month's value forward. |
| 4 | Update the Findings sheet from the control review and the session reviews: each finding's actions, how many are done, and the next action due. |
| 5 | Read the Dashboard: status and direction calculate. Write the position in one sentence for the leadership team, and a coverage note where a measure covers less than its definition. |
| 6 | Every measure goes monthly to the security and IT leadership team. A measure outside tolerance goes to the next executive committee with its plan. Keep a copy of each month's workbook as the record. |
| 7 | To clear the EXAMPLE, delete the contents of the Example column and of every yellow cell on Monthly Values and Findings, and the yellow commentary on the Dashboard. Keep the measures on the Metrics sheet. |
Legend
Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.
| EXAMPLE | Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval. |
EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders. Its September 2026 dashboard, as at 30 Sep 2026. Privileged accounts fell from 22 to 18 after the access review. Tier 0 moved to just-in-time in September, so 2 of 5 administrator accounts are on it, within the tolerance set until Tier 1 moves. One break-glass use was reviewed 14 working days late: PAM-06 is outside tolerance and goes to the executive committee.
Adapting for a small organisation: report PAM-01, PAM-03 and PAM-04 every month and the others each quarter. Keep the status in words and the direction for every one you report.
Adapting for a regulated entity (NIS2, DORA): the dashboard is the record that privileged access controls are measured and their effectiveness evaluated over time. Keep each month's copy with its sources.
Adapting where a service provider runs your IT: the provider can supply PAM-01, PAM-03 and PAM-04 from its tools, but the figures are checked against your own inventory before they are reported. The status is yours, not the provider's.
Dashboard
Privileged access: monthly dashboard
For the security and IT leadership team (RL-1). Yellow cells are yours; everything else calculates from Metrics and Monthly Values. Every status is in words; the colour only repeats it.
Report settings
| Setting | Value | |
|---|---|---|
| Report month (its last day) | 30 Sep 2026 | EXAMPLE: September, the quarter's last month. |
| As-at date (the day it was read) | 30 Sep 2026 |
This month at a glance
| Status | Measures |
|---|---|
| On target | 2 |
| Below target, within tolerance | 3 |
| Outside tolerance | 1 |
| No target set | 1 |
| Not measured | 0 |
The position in one sentence
Tier 0 is on security keys and just-in-time access since 21 Sep 2026; 2 of 5 Tier 0 and Tier 1 administrator accounts are just-in-time, 38 daily accounts still have administrator rights, and the first reviews found an unowned service account, an unreviewed break-glass use and one tier breach, all being fixed by 28 Oct 2026.
The headline measures
| Measure | 31 Jul 2026 | 31 Aug 2026 | 30 Sep 2026 | Target | Tolerance | Status | Direction | Coverage note |
|---|---|---|---|---|---|---|---|---|
| PAM-01 Privileged accounts | 22 | 22 | 18 | Every one in the inventory with an owner; the count level or falling | None set | No target set | Better (was 22) | By tier at the month end: Tier 0 7, Tier 1 8, Tier 2 3. 4 removed in the quarter's access review. |
| PAM-02 Administrator accounts on just-in-time access | 0 of 7 | 0 of 7 | 2 of 5 | All | [[40% until Tier 1 moves on 19 Oct 2026]] | Below target, within tolerance | Better (was 0 of 7) | Tier 0 moved to just-in-time on 21 Sep 2026; Tier 1 follows on 19 Oct 2026, on its approved plan. |
| PAM-03 Daily accounts with administrator rights | 146 | 146 | 38 | Zero | [[40 until the last are removed by 31 Oct 2026 (PIA-01)]] | Below target, within tolerance | Better (was 146) | Removal began on 1 Sep 2026 under PIA-01. At the two smaller warehouses, where the label-printing software needs administrator rights to update. Its supplier's fixed version is due in October; until then the rights stay, and the devices are in the Tier 2 session review sample. |
| PAM-04 Credentials changed on time | Not measured | Not measured | 7 of 8 | All | [[85%]] | Below target, within tolerance | No previous value | First measured when the inventory was built on 16 Sep 2026. Late: svc-wms-db (PF-01). |
| PAM-05 Reviews on time | Not measured | Not measured | 2 of 2 | All | Same as the target | On target | No previous value | Reported for the systems in P07's privileged scope. The cloud tenant's administrator roles (PS-02) were first listed in this inventory; they join the access review's privileged scope from the Q4 2026 campaign. |
| PAM-06 Break-glass uses reviewed on time | Not measured | Not measured | 0 of 1 | All | Same as the target: every use | Outside tolerance | No previous value | BGU-2026-01 reviewed 14 working days late (PF-02, closed). |
| PAM-07 Session reviews on time | Not measured | Not measured | 1 of 1 | All | Same as the target | On target | No previous value | The weekly Tier 0 review began with the week of 21 Sep 2026; the first monthly Tier 1 and supplier reviews fall due in October. |
Status: On target; Below target, within tolerance; Outside tolerance; No target set; or Not measured. Direction is Better, Same or Worse than last month, with last month's figure.
Where this report goes (PA-18)
Outside tolerance: 1 measure(s). Take each, with its plan, to the next executive committee (RL-2).
Every measure goes monthly to the security and IT leadership team. A measure outside tolerance goes to the next executive committee with its plan.
Metrics
The headline measures (PA-18), each with its definition, target and tolerance limit. A share is a number from 0 to 1. PAM-05 is P07's ARM-01, unchanged (P11 MR-04).
| Example | Metric ID | Measure | Definition | Unit | Better when | Target in words | Target | Tolerance limit | Tolerance in words | Taken from | Value this month (calc) | Out of (calc) | Figure (calc) | This month (calc) | Status (calc) | Last month's figure (calc) | Last month's value (calc) | Last month (calc) | Direction (calc) | Coverage note | Two months ago (calc) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | PAM-01 | Privileged accounts | Enabled privileged accounts at month end, by type and tier. Built-in administrator accounts managed by the local administrator password solution count once for each kind of device. | Count | lower | Every one in the inventory with an owner; the count level or falling | None set | Privileged & Service Account Inventory, Summary sheet | 18 | 0 | 18.000 | 18 | No target set | 22.000 | 22 | 22 | Better (was 22) | By tier at the month end: Tier 0 7, Tier 1 8, Tier 2 3. 4 removed in the quarter's access review. | 22 | ||
| EXAMPLE | PAM-02 | Administrator accounts on just-in-time access | Named and supplier administrator accounts with change rights in Tier 0 or Tier 1 that hold no standing rights there, out of all such accounts. | Share | higher | All | 1.000 | 0.400 | [[40% until Tier 1 moves on 19 Oct 2026]] | Privileged & Service Account Inventory, Summary sheet | 2 | 5 | 0.400 | 2 of 5 | Below target, within tolerance | 0.000 | 0 | 0 of 7 | Better (was 0 of 7) | Tier 0 moved to just-in-time on 21 Sep 2026; Tier 1 follows on 19 Oct 2026, on its approved plan. | 0 of 7 |
| EXAMPLE | PAM-03 | Daily accounts with administrator rights | Daily accounts that hold administrator rights anywhere, including local administrator rights on a device. | Count | lower | Zero | 0.000 | 40.000 | [[40 until the last are removed by 31 Oct 2026 (PIA-01)]] | Device management or group policy | 38 | 0 | 38.000 | 38 | Below target, within tolerance | 146.000 | 146 | 146 | Better (was 146) | Removal began on 1 Sep 2026 under PIA-01. At the two smaller warehouses, where the label-printing software needs administrator rights to update. Its supplier's fixed version is due in October; until then the rights stay, and the devices are in the Tier 2 session review sample. | 146 |
| EXAMPLE | PAM-04 | Credentials changed on time | Shared, service and break-glass credentials within their rotation period at month end, out of all such credentials. | Share | higher | All | 1.000 | 0.850 | [[85%]] | Privileged & Service Account Inventory, Inventory sheet | 7 | 8 | 0.875 | 7 of 8 | Below target, within tolerance | Not measured | No previous value | First measured when the inventory was built on 16 Sep 2026. Late: svc-wms-db (PF-01). | Not measured | ||
| EXAMPLE | PAM-05 | Reviews on time | In-scope systems reviewed within their frequency, out of all in-scope systems. | Share | higher | All | 1.000 | 1.000 | Same as the target | Access review (P07), as P11 catalogues it | 2 | 2 | 1.000 | 2 of 2 | On target | Not measured | No previous value | Reported for the systems in P07's privileged scope. The cloud tenant's administrator roles (PS-02) were first listed in this inventory; they join the access review's privileged scope from the Q4 2026 campaign. | Not measured | ||
| EXAMPLE | PAM-06 | Break-glass uses reviewed on time | Break-glass uses in the quarter that were declared, reviewed by the Head of Information Security and followed by a credential change, each within [[1]] working day, out of all uses. | Share | higher | All | 1.000 | 1.000 | Same as the target: every use | Break-Glass Account Control Checklist, Uses and Summary sheets | 0 | 1 | 0.000 | 0 of 1 | Outside tolerance | Not measured | No previous value | BGU-2026-01 reviewed 14 working days late (PF-02, closed). | Not measured | ||
| EXAMPLE | PAM-07 | Session reviews on time | Session reviews due in the month that were done by their due date, out of all due. | Share | higher | All | 1.000 | 1.000 | Same as the target | Privileged Session Review Record | 1 | 1 | 1.000 | 1 of 1 | On target | Not measured | No previous value | The weekly Tier 0 review began with the week of 21 Sep 2026; the first monthly Tier 1 and supplier reviews fall due in October. | Not measured |
Monthly Values
One row per measure per month, from the source on the Sources sheet. Month end is the month's last day. A measure not measured has no row.
| Example | Month end | Metric ID | Measure (calc) | Value | Out of (for a share) | Note | Key (calc) |
|---|---|---|---|---|---|---|---|
| EXAMPLE | 31 Jul 2026 | PAM-01 | Privileged accounts | 22 | PAM-01|46234 | ||
| EXAMPLE | 31 Aug 2026 | PAM-01 | Privileged accounts | 22 | PAM-01|46265 | ||
| EXAMPLE | 30 Sep 2026 | PAM-01 | Privileged accounts | 18 | PAM-01|46295 | ||
| EXAMPLE | 31 Jul 2026 | PAM-02 | Administrator accounts on just-in-time access | 0 | 7 | PAM-02|46234 | |
| EXAMPLE | 31 Aug 2026 | PAM-02 | Administrator accounts on just-in-time access | 0 | 7 | PAM-02|46265 | |
| EXAMPLE | 30 Sep 2026 | PAM-02 | Administrator accounts on just-in-time access | 2 | 5 | PAM-02|46295 | |
| EXAMPLE | 31 Jul 2026 | PAM-03 | Daily accounts with administrator rights | 146 | PAM-03|46234 | ||
| EXAMPLE | 31 Aug 2026 | PAM-03 | Daily accounts with administrator rights | 146 | PAM-03|46265 | ||
| EXAMPLE | 30 Sep 2026 | PAM-03 | Daily accounts with administrator rights | 38 | PAM-03|46295 | ||
| EXAMPLE | 30 Sep 2026 | PAM-04 | Credentials changed on time | 7 | 8 | PAM-04|46295 | |
| EXAMPLE | 30 Sep 2026 | PAM-05 | Reviews on time | 2 | 2 | PAM-05|46295 | |
| EXAMPLE | 30 Sep 2026 | PAM-06 | Break-glass uses reviewed on time | 0 | 1 | PAM-06|46295 | |
| EXAMPLE | 30 Sep 2026 | PAM-07 | Session reviews on time | 1 | 1 | PAM-07|46295 |
Findings
The findings behind the measures, from the Privileged Access Control Review Workbook and the session reviews. A finding closes when every action is done.
| Example | Finding | Found on | Source | Account | Rules | Finding in brief | Actions | Actions done | Status (calc) | Next action | Due | Due check (calc) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | PF-01 | 24 Sep 2026 | CR-2026-01 | svc-wms-db | PA-01, PA-10, PA-11, PA-15 | The warehouse system's database service account had no owner and was not in the inventory. It could sign in interactively, its password had not changed since the system was installed on 14 Mar 2019, and the supplier's support staff used it to sign in through the remote support tool, most recently on 16 Sep 2026. | 5 | 1 | Open | Change the password in the Sunday change window and put it in the vault (IT Operations Manager) | 4 Oct 2026 | On plan |
| EXAMPLE | PF-02 | 24 Sep 2026 | CR-2026-01 | bg-cloud-01 | PA-12 | The break-glass use on 5 Sep 2026 was declared and the credential changed on time, but nobody reviewed the session: the Head of IT thought the provider would, and the provider thought the Head of IT would. | 2 | 2 | Closed | |||
| EXAMPLE | PF-03 | 28 Sep 2026 | SR-2026-W39 | adm-pshah | PA-02, PA-13 | One account held Tier 0 rights (Backup Operators) and Tier 1 rights (Server Admins). With the Tier 0 elevation active, it signed in to a Tier 1 file server, where the Tier 0 credential could have been captured. | 3 | 2 | Open | Split the account into a Tier 0 and a Tier 1 account, and deny Tier 0 groups sign-in on Tier 1 servers (Head of IT) | 28 Oct 2026 | On plan |
Sources
Sources and reporting
Where each measure is taken from, and where the report goes. Take each value from its source after the month end; the figures are checked against the source before they are reported.
| Measure | Name | Taken from | How it is counted |
|---|---|---|---|
| PAM-01 | Privileged accounts | Privileged & Service Account Inventory, Summary sheet | Enabled accounts at the month end, by type, tier and month. |
| PAM-02 | Administrator accounts on just-in-time access | Privileged & Service Account Inventory, Summary sheet | From the inventory's two just-in-time columns. |
| PAM-03 | Daily accounts with administrator rights | Device management or group policy | Members of every local and directory administrator group, compared with the list of daily accounts (PA-03). |
| PAM-04 | Credentials changed on time | Privileged & Service Account Inventory, Inventory sheet | The rotation status of every shared, service and break-glass credential at the month end. |
| PAM-05 | Reviews on time | Access review (P07), as P11 catalogues it | Imported unchanged: name, definition and target are P07's ARM-01, carried as P11's MC-21. |
| PAM-06 | Break-glass uses reviewed on time | Break-Glass Account Control Checklist, Uses and Summary sheets | Uses in the quarter, each declared, reviewed and followed by a credential change within [[1]] working day. |
| PAM-07 | Session reviews on time | Privileged Session Review Record | Each session review's due date and the date it was done. |
P11 MR-04: "Where another pack already defines a measure, the catalogue must use that definition and target unchanged. A change is made in the pack that owns it, never in the catalogue."
Reporting levels (P11)
| Level | Audience | Cadence | Purpose |
|---|---|---|---|
| RL-1 | Security and IT leadership team | Monthly | Run the controls. Every catalogue metric the organisation uses, with trend, zone or status, and owner commentary. |
| RL-2 | Executive committee | Monthly | Decide. The position against appetite, KRIs outside green, KPIs short of target, and the decisions the committee must take. |
Rules
Rules this workbook applies
The rules come from the Privileged Access Standard and keep their IDs across the pack. Change a rule there, never here: this sheet quotes it.
| Rule | Requirement | Where this workbook applies it |
|---|---|---|
| PA-01 | Every privileged account, human and non-human, must be in the inventory with a named owner, its tier, its purpose, where its credential is kept and when it was last changed. An account found that is not in the inventory is disabled unless an owner claims it within [[5]] working days. For a service account, assign an interim owner within that window to control its use while dependencies are checked under PA-11; the 30-day limit is not permission to leave it uncontrolled. | PAM-01: every privileged account in the inventory with an owner. |
| PA-03 | A daily account must hold no administrator rights anywhere, including local administrator rights on the person's own device. Support uses the local administrator password solution instead. | PAM-03: daily accounts with administrator rights; the target is zero. |
| PA-06 | Privileged rights in Tier 0 and Tier 1 must be just-in-time: eligible, activated for one task and ended after no more than [[4]] hours in Tier 0 and [[8]] hours in Tier 1. Standing rights are allowed only for break-glass and service accounts, Tier 2 support on separate Tier 2 accounts, read-only monitoring, and application roles the application cannot assign for a time, each recorded in the inventory. | PAM-02: Tier 0 and Tier 1 administrator accounts on just-in-time access. |
| PA-09 | Privileged activity must be reviewed at the cadence the session review table sets, by someone with no administrator rights in that tier. Anything unexplained is followed up and recorded. | PAM-07: session reviews done by their due date. |
| PA-10 | Shared, service and break-glass credentials must be kept in the vault or managed by the platform, and changed as the rotation table sets, after every use where it says so, and at once on suspicion of compromise. | PAM-04: shared, service and break-glass credentials within their rotation period. |
| PA-12 | There must be [[2]] break-glass accounts for each cloud identity tenant and [[1]] for each on-premises directory, sealed in the safe, alerting on every sign-in and tested every [[3]] months. They are used only when the normal route is unavailable, and every use is declared, reviewed and followed by a credential change within [[1]] working day. | PAM-06: every break-glass use declared, reviewed and followed by a credential change in time. |
| PA-16 | Privileged access must be reviewed every [[3]] months by the system owner and information security (P07 AR-02, AR-06), and the controls of this standard tested system by system at least once a year, and every [[6]] months for Tier 0. | PAM-05: privileged access reviewed every quarter by the system owner and information security. |
| PA-18 | Any departure from this standard must be a P02 exception, scored and approved by the approver its band sets (EX-05); a Critical exception is approved by the board or its equivalent. The headline measures are reported monthly to the security and IT leadership team. | The whole dashboard: reported monthly to the security and IT leadership team; a measure outside tolerance goes to the executive committee. |
When a measure will stay outside tolerance
| ID | Request | Approver |
|---|---|---|
| AP-8 | An exception to this standard. A measure that will stay outside tolerance because the standard will not be met is recorded as an exception, scored and approved, and reported with its expiry until it closes. | The P02 approver for the exception's band (EX-05): for a Critical exception, the board, or a board risk committee it has delegated this to; in a two-tier structure, the management board; where there is no board, such as in an owner-managed company, executive management |
Lists
| MetricID | MetricName | Unit | Better |
|---|---|---|---|
| PAM-01 | Privileged accounts | Count | higher |
| PAM-02 | Administrator accounts on just-in-time access | Share | lower |
| PAM-03 | Daily accounts with administrator rights | ||
| PAM-04 | Credentials changed on time | ||
| PAM-05 | Reviews on time | ||
| PAM-06 | Break-glass uses reviewed on time | ||
| PAM-07 | Session reviews on time |
Definitions
Definitions
| Term | Meaning in this workbook |
|---|---|
| Headline measure | One of PAM-01 to PAM-07, reported monthly to the security and IT leadership team (PA-18). |
| Target | The figure the measure should reach. A share is written from 0 to 1: 1 means all. |
| Tolerance limit | How far short of the target a measure may be before it is outside tolerance. Set by the leadership team; where it equals the target, any shortfall is outside. |
| Status: On target | At or better than the target. |
| Status: Below target, within tolerance | Short of the target but inside the tolerance limit. The coverage note gives the plan and its date. |
| Status: Outside tolerance | Beyond the tolerance limit. It goes to the next executive committee with its plan. |
| Status: No target set | Reported without a numeric target, as PAM-01 is: its direction is what is read. |
| Not measured | No value for the month. Last month's value is never carried forward. |
| Direction | Better, Same or Worse than last month, read with 'Better when', with last month's figure in brackets. 'No previous value' when there is none. |
| Out of | For a share, the number the value is counted from: 2 of 5 is a share of 0.4. |
| Coverage note | What the measure does not yet cover, or why it moved, in a sentence. |
| (calc) | A column or cell the workbook calculates. Do not type or paste over it. |
| EXAMPLE | A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, as at 30 Sep 2026. Delete before use. |
Framework References
Framework references
These references indicate relevance only and do not reproduce the text of any standard.
| Framework | Reference | Supported by |
|---|---|---|
| ISO/IEC 27001:2022 | Clause 9.1 — Monitoring, measurement, analysis and evaluation | The dashboard as a whole: what is measured, when, from which source, and the results evaluated each month |
| NIST CSF 2.0 | GV.OV-03 — “Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed” | Status and direction: the performance of privileged access management evaluated and reviewed monthly |
| NIS2 — Directive (EU) 2022/2555 | Article 21(2)(i) — “human resources security, access control policies and asset management” | The measures show whether the access control policy works for privileged access |
| DORA — Regulation (EU) 2022/2554 | Article 9(4)(c) — policies that limit access to information and ICT assets to what is required for legitimate and approved functions, with controls that ensure sound administration of access rights | PAM-01 to PAM-04: access limited to what is required, measured over time (financial entities) |
| ISO/IEC 27001:2022 | Annex A 8.2 — Privileged access rights | PAM-01 to PAM-04 and PAM-06: the allocation and use of privileged access rights, measured |
ISO/IEC 27001 references name the clause or control this document relates to. They do not say that meeting it meets any other framework's requirement.