Privileged & Service Account Inventory

What's inside

What changed

Preview

Instructions

Inventory

Discovery

Account types

Summary

Rules

Lists

Definitions

Framework References

Lists every privileged human and non-human account with owner, purpose, credential storage and rotation status.

Available soon

Format: Excel
Size: 78 KB
Length: 12 sheets
Version: 2.0
Updated: 1 Oct 2026

Follow this documentFree account. We can email you when it changes.

Instructions
Inventory
Discovery
Account types
Summary
Rules
Lists
Definitions
Framework References

2.01 Oct 2026
Rewritten to the depth of the other CISO Times packs: all 22 of the example's accounts with their rights, tiers, sign-in method, just-in-time status and credential; next change and rotation status from the rotation table; owner, tier and rights checks; a Discovery sheet with the claim and disable deadlines; the service account steps and removal times; and a Summary giving PAM-01, PAM-02 and PAM-04.
1.01 Oct 2026
Published.

Changes across this pack

The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.

How to use this workbook

Step	What to do
1	Set the as-at date at the top of the Summary sheet. The EXAMPLE uses 2026-09-30, the quarter end; use the month end you report for. Check the rotation periods on the Account types sheet against your Privileged Access Standard: the formulas read them from there.
2	List the systems that hold privileged accounts on the Lists sheet, each with its tier from the Administrative Tier Model & Separation Matrix. Every right you record names one of them.
3	Build the first inventory from each system's own lists: administrator groups and roles, accounts whose password never expires, accounts that run a service or task, built-in administrators and supplier accounts. One row per account on Inventory.
4	For each account record its type (AT-01, AT-02, AT-03, AT-04, AT-05, AT-06), the person who holds it, the named owner, the organisation, its rights and the system each is on, and the tiers those systems are in. A service, shared or break-glass account has no holder: leave Holder blank and name its owner.
5	Answer the two just-in-time columns for the as-at date: can the account change anything in Tier 0 or Tier 1, and are all those rights eligible rather than active? Read-only monitoring is not a change right.
6	For every shared, service and break-glass credential, enter where it is kept, its rotation row and the date it was last changed. The next change and the rotation status calculate. Change a credential at once on suspicion of compromise, and within [[1]] working day of anyone who could read it leaving or moving (PA-14).
7	When an account is disabled or deleted, enter the date in "Removed on" and keep the row: the Summary counts the quarter's removals.
8	An account found outside the inventory goes on Discovery the day it is found. Name an owner within the claim period, or disable it; for a service account, name an interim owner and follow the steps on Account types (PA-01, PA-11). Once claimed, add it to Inventory.
9	Clear every check that does not say "OK", and take each measure on the Summary sheet to the monthly report in the Privileged Access Metrics Dashboard.
10	To clear the EXAMPLE, delete the contents of the Example column and of every yellow cell on Inventory and Discovery. Keep the formulas in the white columns, the account types and the rotation table.

Legend

Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.

EXAMPLE

Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval.

EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, as at 30 Sep 2026. It built this inventory on 16 Sep 2026 from the access review campaign's extracts and its own lists, and moved Tier 0 to security keys and time-limited elevation on 21 Sep 2026. Four accounts went in the quarter's access review (adm-kwalsh, adm-migration, adm-rpatel, j.harper), leaving 18 enabled. The control review on 24 Sep 2026 found svc-wms-db, a warehouse system service account nobody owned, with interactive logon allowed and a password unchanged since 14 Mar 2019 (PF-01). The IT Operations Manager claimed it on 25 Sep 2026; its password is the one credential overdue. The managed IT provider's engineer accounts ext-msp-aturner and ext-msp-bowen keep standing Tier 1 rights under P02 exception EX-2026-030, approved by the Head of Information Security (Medium), until 19 Oct 2026. The two Tier 2 administrator accounts, adm-dmorgan and adm-lchen, still sign in with an authenticator app with number matching: each row records it under PA-05, with the move to security keys by 2 Nov 2026, in rollout stage 2.

Adapting for a small organisation: the inventory may be a dozen rows. Keep every built-in and break-glass account and every service account in it, because those are the ones nobody remembers. Where one person is both Head of IT and IT Operations Manager, the Head of Information Security approves that person's own accounts.

Adapting for a regulated entity (NIS2, DORA): the inventory is the record that privileged and system administration accounts are managed under a policy, and that credentials are changed at set intervals and on suspicion of compromise (Implementing Regulation (EU) 2024/2690 Annex 11.3.1 and 11.6.2(c)). Keep each month-end copy.

Adapting where a service provider runs your IT: ask the provider for its own list of accounts it holds on your systems, and reconcile it with this inventory every month. Its engineers' accounts are supplier administrator accounts (AT-02), owned by your system owner, never by the provider.

One row per privileged account (PA-01). Yellow columns are inputs; white columns calculate against the as-at date on the Summary sheet. Rights are given with their system in brackets; "Tiers held" lists every tier those systems are in.

Example	Account ID	Account	Type ID	Type (calc)	Holder	Owner	Organisation	Rights held (system)	Tiers held	Top tier (calc)	Sign-in method	Change rights in Tier 0 or 1	All just-in-time	Credential kept	Interactive logon	Rotation row	Last changed	Next change due (calc)	Rotation status (calc)	Removed on	Status (calc)	Owner check (calc)	Tier check (calc)	Rights check (calc)	Finding or exception
EXAMPLE	ACC-01	adm-mellis	AT-01	Named administrator account	Mark Ellis	Mark Ellis	Internal	Domain Admins (PS-01); Global Administrator (eligible) (PS-02)	0	0	Security key	Yes	Yes	The person's own long, unique password, with a phishing-resistant second factor	Yes, from an administration device only				Not a shared credential		Enabled	OK	OK	OK
EXAMPLE	ACC-02	adm-jnovak	AT-01	Named administrator account	Jana Novak	Jana Novak	Internal	Domain Admins (PS-01); Global Administrator (eligible) (PS-02)	0	0	Security key	Yes	Yes	The person's own long, unique password, with a phishing-resistant second factor	Yes, from an administration device only				Not a shared credential		Enabled	OK	OK	OK
EXAMPLE	ACC-03	adm-pshah	AT-01	Named administrator account	Priya Shah	Priya Shah	Internal	Server Admins (PS-08); Backup Operators (PS-01)	0, 1	0	Security key	Yes	No	The person's own long, unique password, with a phishing-resistant second factor	Yes, from an administration device only				Not a shared credential		Enabled	OK	Spans tiers: split it (SR-1)	Standing rights: move to just-in-time (PA-06)	PF-03
EXAMPLE	ACC-04	adm-dmorgan	AT-01	Named administrator account	Dan Morgan	Dan Morgan	Internal	Helpdesk Admins (PS-09)	2	2	Authenticator app with number matching. Recorded under PA-05: the strongest method set up for Tier 2 until rollout stage 2 issues their keys; moves to security keys by 2 Nov 2026	No		The person's own long, unique password, with a phishing-resistant second factor	Yes, from an administration device only				Not a shared credential		Enabled	OK	OK	OK
EXAMPLE	ACC-05	adm-lchen	AT-01	Named administrator account	Li Chen	Li Chen	Internal	Helpdesk Admins (PS-09)	2	2	Authenticator app with number matching. Recorded under PA-05: the strongest method set up for Tier 2 until rollout stage 2 issues their keys; moves to security keys by 2 Nov 2026	No		The person's own long, unique password, with a phishing-resistant second factor	Yes, from an administration device only				Not a shared credential		Enabled	OK	OK	OK
EXAMPLE	ACC-06	ext-msp-aturner	AT-02	Supplier administrator account	Alex Turner	Mark Ellis	SUP-001	Server Admins (PS-08)	1	1	Security key	Yes	No	As a named administrator account; enabled only for the agreed window	Yes, from the agreed route only				Not a shared credential		Enabled	OK	OK	Standing rights: move to just-in-time (PA-06)	EX-2026-030
EXAMPLE	ACC-07	ext-msp-bowen	AT-02	Supplier administrator account	Beth Owen	Mark Ellis	SUP-001	Server Admins (PS-08)	1	1	Security key	Yes	No	As a named administrator account; enabled only for the agreed window	Yes, from the agreed route only				Not a shared credential		Enabled	OK	OK	Standing rights: move to just-in-time (PA-06)	EX-2026-030
EXAMPLE	ACC-08	ext-soc-nfield	AT-02	Supplier administrator account	Nina Field	Mark Ellis	SUP-006	Event Log Readers (PS-08)	1	1	Security key	No		As a named administrator account; enabled only for the agreed window	Yes, from the agreed route only				Not a shared credential		Enabled	OK	OK	OK
EXAMPLE	ACC-09	svc-backup	AT-04	Service account		Priya Shah	Internal	Backup Operators (PS-01)	0	0		Yes	No	Vault	Denied	RT-4	2 Mar 2026	2 Mar 2027	In date		Enabled	OK	OK	OK
EXAMPLE	ACC-10	bg-emergency	AT-06	Break-glass account		Mark Ellis	Internal	Domain Admins (PS-01)	0	0		Yes	No	Sealed in the safe	Emergency only	RT-7	14 Sep 2026	14 Sep 2027	In date		Enabled	OK	OK	OK
EXAMPLE	ACC-11	adm-kwalsh	AT-01	Named administrator account	Kieran Walsh	Kieran Walsh	Internal	Domain Admins (PS-01)	0	0	Text message	Yes	No	The person's own long, unique password, with a phishing-resistant second factor	Yes, from an administration device only				Removed	9 Sep 2026	Removed
EXAMPLE	ACC-12	adm-migration	AT-05	Shared or built-in administrator account			Internal	Domain Admins (PS-01)	0	0		Yes	No	Not recorded	Allowed	RT-6	3 Nov 2025	3 Feb 2026	Removed	9 Sep 2026	Removed
EXAMPLE	ACC-13	adm-rpatel	AT-01	Named administrator account	Ravi Patel	Ravi Patel	Internal	Server Admins (PS-08)	1	1	Text message	Yes	No	The person's own long, unique password, with a phishing-resistant second factor	Yes, from an administration device only				Removed	9 Sep 2026	Removed
EXAMPLE	ACC-14	elena.lopez	AT-03	Application administrator role	Elena Lopez	Helen Carter	Internal	Store administrator (PS-07)	1	1	The console's own authenticator app code. Recorded under PA-05: the console has no single sign-on and offers nothing stronger until the single sign-on project; moves to single sign-on with a security key by 31 Mar 2027	Yes	No	Single sign-on with a phishing-resistant factor where the application allows; otherwise the strongest method it offers, recorded	Yes				Not a shared credential		Enabled	OK	OK	OK
EXAMPLE	ACC-15	helen.carter	AT-03	Application administrator role	Helen Carter	Helen Carter	Internal	Store administrator (PS-07)	1	1	The console's own authenticator app code. Recorded under PA-05: the console has no single sign-on and offers nothing stronger until the single sign-on project; moves to single sign-on with a security key by 31 Mar 2027	Yes	No	Single sign-on with a phishing-resistant factor where the application allows; otherwise the strongest method it offers, recorded	Yes				Not a shared credential		Enabled	OK	OK	OK
EXAMPLE	ACC-16	j.harper	AT-03	Application administrator role		Helen Carter	Internal	Store administrator (PS-07)	1	1	Password only	Yes	No	Single sign-on with a phishing-resistant factor where the application allows; otherwise the strongest method it offers, recorded	Yes				Removed	11 Sep 2026	Removed
EXAMPLE	ACC-17	bg-cloud-01	AT-06	Break-glass account		Mark Ellis	Internal	Global Administrator (PS-02)	0	0	Sealed security key	Yes	No	Sealed in the safe (password and security key)	Emergency only	RT-7	14 Sep 2026	14 Sep 2027	In date		Enabled	OK	OK	OK
EXAMPLE	ACC-18	bg-cloud-02	AT-06	Break-glass account		Mark Ellis	Internal	Global Administrator (PS-02)	0	0	Sealed security key	Yes	No	Sealed in the safe (password and security key)	Emergency only	RT-7	14 Sep 2026	14 Sep 2027	In date		Enabled	OK	OK	OK
EXAMPLE	ACC-19	svc-wms-db	AT-04	Service account		IT Operations Manager	Internal	Local administrator, both warehouse system servers (PS-06)	1	1		Yes	No	In the supplier's support notes; not in the vault	Allowed	RT-4	14 Mar 2019	14 Mar 2020	Overdue		Enabled	OK	OK	Service account can sign in (PA-11)	PF-01
EXAMPLE	ACC-20	fw-admin	AT-05	Shared or built-in administrator account		IT Operations Manager	Internal	Firewall administrator (PS-08)	1	1		Yes	No	Vault	Opened from the vault	RT-6	1 Jul 2026	1 Oct 2026	Due soon		Enabled	OK	OK	OK
EXAMPLE	ACC-21	Built-in Administrator, each server	AT-05	Shared or built-in administrator account		IT Operations Manager	Internal	Local Administrators (PS-08)	1	1		Yes	No	Local administrator password solution	Opened from the directory, logged	RT-5	12 Sep 2026	12 Oct 2026	Due soon		Enabled	OK	OK	OK
EXAMPLE	ACC-22	Built-in Administrator, each office PC	AT-05	Shared or built-in administrator account		IT Operations Manager	Internal	Local Administrators (PS-09)	2	2		No		Local administrator password solution	Opened from the directory, logged	RT-5	18 Sep 2026	18 Oct 2026	In date		Enabled	OK	OK	OK

Accounts found outside the inventory: claimed within [[5]] working days or disabled; an unowned service account disabled after [[30]] days and deleted [[90]] days later (PA-01, PA-11).

Example	Account found	Found on	How it was found	Type ID	System ID	What it can do	Claim by (calc)	Owner named	Owner named on	Disable by if no owner (calc)	Disabled on	Delete after (calc)	Added to the inventory as	Result (calc)	Finding
EXAMPLE	svc-wms-db	24 Sep 2026	Control review CR-2026-01, test CT-01	AT-04	PS-06	Local administrator, both warehouse system servers	1 Oct 2026	IT Operations Manager	25 Sep 2026	24 Oct 2026			ACC-19	Claimed on time, in the inventory	PF-01

Account types, rotation periods and removal times

The kinds of privileged account, how often each credential is changed (PA-10), service accounts nobody owns (PA-11) and removal times (PA-14). The Inventory formulas read the yellow rotation periods: change them here after changing the Privileged Access Standard.

Account types

ID	Type	Who uses it	Owner	Credential	Interactive logon	Standing rights
AT-01	Named administrator account	One member of staff, for one tier	The person	The person's own long, unique password, with a phishing-resistant second factor	Yes, from an administration device only	Tier 2 only
AT-02	Supplier administrator account	One named engineer of a supplier, for one tier	The system owner, with the supplier accountable for its engineer	As a named administrator account; enabled only for the agreed window	Yes, from the agreed route only	Tier 2 only, or read-only monitoring
AT-03	Application administrator role	A member of staff who administers a business application	The system owner	Single sign-on with a phishing-resistant factor where the application allows; otherwise the strongest method it offers, recorded	Yes	Where the application cannot assign roles for a time, recorded
AT-04	Service account	Software: a service, a scheduled task or an integration	A named person, never a team or a supplier	Managed by the platform where it can be; otherwise in the vault	No: denied by policy	Yes, the least it needs to run
AT-05	Shared or built-in administrator account	Whoever opens it from the vault, one person at a time	A named person	In the vault, or managed by the local administrator password solution; changed after use	Yes, recorded by the vault	Yes, as the system requires; used only by opening the vault
AT-06	Break-glass account	Any authorised administrator, only when the normal route is unavailable	The Head of IT	Sealed in the safe and not tied to the normal sign-in route (PA-12)	Yes, in an emergency only	Yes, by design

Rotation periods (PA-10)

Row	Applies to	Credential	Every (months)	Every (days)	When it is changed
RT-1	AT-01 Named administrator account	Named administrator's password	12		At least every [[12]] months; sign-in always also needs the phishing-resistant factor
RT-2	AT-02 Supplier administrator account	Supplier administrator's password	12		At least every [[12]] months, as a named administrator account
RT-3	AT-04 Service account	Service account managed by the platform		30	Automatically, at least every [[30]] days
RT-4	AT-04 Service account	Service account not managed by the platform	12		At least every [[12]] months, in a planned change window
RT-5	AT-05 Shared or built-in administrator account	Built-in administrator managed by the local administrator password solution		30	Automatically, at least every [[30]] days, and after every use
RT-6	AT-05 Shared or built-in administrator account	Shared administrator account in the vault	3		At least every [[3]] months, and after every use
RT-7	AT-06 Break-glass account	Break-glass account	12		After every use or test that opens the seal, and at least every [[12]] months

Enter either months or days for each row, not both. Every credential is also changed at once on suspicion of compromise, and within [[1]] working day of anyone who could read it leaving or moving.

Service accounts nobody owns, step by step

When privileged access is removed (PA-14)

ID	When	What is removed, and how fast
RV-1	A planned leaver	All privileged accounts disabled by the end of the last working day, at the latest when the daily account is
RV-2	An urgent leaver, or one leaving on bad terms	All privileged accounts disabled at once, before the person is told, and their sessions ended
RV-3	A mover whose new role does not need the access	Removed on the day the move takes effect
RV-4	A supplier engineer who leaves or no longer needs access	The supplier must remove access within [[1]] working day of a person leaving the supplier or no longer needing it (P06 CL-09, 9.3). Where we hold the account, we disable it the same day we learn of the leaver.
RV-5	Anyone who could read a shared, service or break-glass credential	Each such credential changed within [[1]] working day of the leaving or move

Summary: the inventory's measures

The settings the inventory's formulas use, and the headline measures it feeds for the Privileged Access Metrics Dashboard: privileged accounts by type, tier and month (PAM-01), administrator accounts on just-in-time access (PAM-02) and credentials changed on time (PAM-04). Yellow cells are yours; everything else calculates.

Settings

Setting	Value	Note
As-at date	30 Sep 2026	EXAMPLE: the quarter end. Use the month end you report for; type it, never a formula.
Warn this many days before a change is due	14	[[14]] days: time to book a change window for a service account.
Working days for an owner to claim a found account (PA-01)	5	From the standard. Change it there first.
Days before an unowned service account is disabled (PA-11)	30	Counted from the day it was found.
Days after disabling before it is deleted (PA-11)	90	If nothing breaks while it is disabled.
Quarter start (calc)	1 Jul 2026	The first day of the quarter that ends with the as-at date's month, for the removals below.

PAM-01 Privileged accounts, by type

Account type	Enabled at the as-at date	Removed in the quarter	Rotation overdue
AT-01 Named administrator account	5	2	0
AT-02 Supplier administrator account	3	0	0
AT-03 Application administrator role	2	1	0
AT-04 Service account	2	0	1
AT-05 Shared or built-in administrator account	3	1	0
AT-06 Break-glass account	3	0	0
All types (PAM-01)	18	4	1

PAM-01's target: every one in the inventory with an owner; the count level or falling.

PAM-01 by tier, and at each month end

All tiers	18
Tier the account can control (its top tier)	Enabled at the as-at date	An account that holds rights in two tiers counts in the higher one (the lower number), and is flagged for splitting (SR-1).
Tier 0	7
Tier 1	8
Tier 2	3

Month end	Enabled at the month end	EXAMPLE: the quarter's three month ends. An account counts until the day it is removed. Accounts added in the period count from their first month end in the inventory.
31 Jul 2026	22
31 Aug 2026	22
30 Sep 2026	18

PAM-02 and PAM-04

Measure	Counted	Out of	Result	How it is counted
PAM-02 Administrator accounts on just-in-time access	2	5	2 of 5	Named and supplier administrator accounts (AT-01, AT-02), enabled, with change rights in Tier 0 or Tier 1: those whose rights there are all just-in-time.
PAM-04 Credentials changed on time	7	8	7 of 8	Enabled accounts with a rotation row (shared, service and break-glass credentials): those not overdue at the as-at date.
PAM-04: the first credential overdue	svc-wms-db			Change it in the next change window, then record the new date on the Inventory.

Checks to clear

Check	Accounts	What to do
Enabled accounts without an owner (PA-01)	0	Name an owner within the claim period, or disable the account.
Accounts that span tiers (SR-1)	1	Split each into one account per tier (PF-03 in the EXAMPLE).
Administrator accounts with standing Tier 0 or Tier 1 rights (PA-06)	3	Move to just-in-time, or record the approved plan and its date, or the P02 exception, in Finding or exception (PA-18).
Service accounts that can sign in interactively (PA-11)	1	Deny interactive logon by policy, once anyone who used it has a named account.
Credentials overdue (PA-10)	1	Change them now.
Credentials due soon	2	Book the change before the date shown on the Inventory.
Found accounts still waiting (Discovery)	0	Name an owner or disable each one by the dates shown.

A count above zero is shown in white on amber; the number is the status.

Rules this workbook applies

The rules come from the Privileged Access Standard and keep their IDs across the pack. Change a rule there, never here: this sheet quotes it.

Rule	Requirement	Where this workbook applies it
PA-01	Every privileged account, human and non-human, must be in the inventory with a named owner, its tier, its purpose, where its credential is kept and when it was last changed. An account found that is not in the inventory is disabled unless an owner claims it within [[5]] working days. For a service account, assign an interim owner within that window to control its use while dependencies are checked under PA-11; the 30-day limit is not permission to leave it uncontrolled.	Inventory: one row per account with its owner, tiers, rights, credential and last change. Discovery: found accounts claimed within the claim period, or disabled.
PA-02	Administration must be done only from a separate administrator account, named for one person and one tier. Administrator accounts are never shared, except the built-in and break-glass accounts held in the vault.	Inventory: named administrator accounts (AT-01, AT-02) are for one person and one tier; the Tier check flags an account that spans two.
PA-05	Every privileged sign-in must use a phishing-resistant method: a security key, a passkey on a managed device, or a certificate. Where a system can use neither the organisation's single sign-on nor such a method, it uses the strongest method it offers, recorded in the inventory with the date it will move.	Inventory: the sign-in method of every human account. A method other than a security key, passkey or certificate is recorded with the date it will move.
PA-06	Privileged rights in Tier 0 and Tier 1 must be just-in-time: eligible, activated for one task and ended after no more than [[4]] hours in Tier 0 and [[8]] hours in Tier 1. Standing rights are allowed only for break-glass and service accounts, Tier 2 support on separate Tier 2 accounts, read-only monitoring, and application roles the application cannot assign for a time, each recorded in the inventory.	Inventory: the two just-in-time columns and the Rights check; PAM-02 on the Summary sheet.
PA-10	Shared, service and break-glass credentials must be kept in the vault or managed by the platform, and changed as the rotation table sets, after every use where it says so, and at once on suspicion of compromise.	Account types: the rotation periods. Inventory: next change due and rotation status; PAM-04 on the Summary sheet.
PA-11	Every service account must have a named owner, do one job with the least rights it needs, and be denied interactive logon. A service account with no owner found within [[30]] days is disabled, and deleted [[90]] days after that if nothing breaks.	Inventory: interactive logon for service accounts, flagged by the Rights check. Discovery: the interim owner, and the disable and delete dates.
PA-14	Privileged access must be removed on the day a person leaves or moves, or at once for an urgent departure. Shared, service and break-glass credentials the person could read are changed within [[1]] working day.	Inventory: Removed on. Account types: how fast privileged access goes for leavers, movers and suppliers.

Who approves a new privileged account (PA-07)

ID	Request	Approver
AP-3	Tier 2 administrator account	IT Operations Manager
AP-4	New Tier 0 administrator account, or any standing right in Tier 0	Head of IT and Head of Information Security, both
AP-5	New Tier 1 administrator account or application administrator role	The system owner and the Head of IT

SysID	SysName	SysTier	SysOwner	YesNo
PS-01	Directory and its administrator groups	0	Head of IT	Yes
PS-02	Cloud identity tenant (email and office, P06 SUP-005)	0	Head of IT	No
PS-03	Backup service console (P06 SUP-011)	0	Head of IT
PS-04	Endpoint protection and device management consoles	0	Head of IT
PS-05	ERP (hosted, P06 SUP-004; P07 SYS-01)	1	Chief Financial Officer
PS-06	Warehouse management system servers (P07 SYS-02)	1	Head of Logistics
PS-07	Online ordering admin console (P07 SYS-04)	1	Chief Operating Officer
PS-08	File and application servers, and the firewalls	1	Head of IT
PS-09	Office PCs and laptops	2	Head of IT

Columns A to D are the system list, each with its tier from the Administrative Tier Model & Separation Matrix. Yellow rows: add your own. The account types and rotation rows are on the Account types sheet.

Definitions

Term	Meaning in this workbook
Privileged access	Rights that let an account change a system's configuration, security settings, users or permissions, read or change data beyond one person's job, or turn off a control. Administrator rights are privileged access; so are an application's administrator roles.
Privileged account	Any account that holds privileged access, standing or when elevated: a named administrator account, a supplier's administrator account, an application administrator role, a service account, a shared or built-in administrator account, or a break-glass account.
Daily account	The account a person uses for email, web browsing, chat and ordinary work. It holds no administrator rights anywhere (PA-03).
Administrator account	A separate account, named for one person and one tier, used only for administration (PA-02). It has no mailbox and is never used for email or web browsing.
Service account	An account used by software, not a person: to run a service, a scheduled task or an integration. It has a named owner and cannot sign in interactively (PA-11).
Shared account	An administrator account more than one person can use, including the built-in administrator accounts of devices and systems. Its credential is held in the vault and changed after use (PA-10).
Break-glass account	An emergency account used only when the normal administration route is unavailable, such as when every administrator is locked out. Sealed, watched, tested and reset after every use (PA-12).
Holder and owner	The holder is the person who signs in with the account. The owner answers for why it exists, what it can do and its credential; for a service, shared or break-glass account there is no holder, only an owner.
Tier	A group of systems that give the same level of control over the organisation. An administrator account belongs to one tier (A08).
Top tier (calc)	The most powerful tier among the tiers an account holds (Tier 0 above Tier 1 above Tier 2). The Summary counts each account once, in its top tier.
Standing rights	Privileged rights an account holds all the time, whether or not the person is doing administration.
Just-in-time	Privileged rights that are eligible but not active. They are switched on for one task, after approval, for no longer than the tier's maximum, and switch off by themselves.
Change rights	Rights that let the account change something on the system. Read-only monitoring rights are not change rights, and are allowed to stand (PA-06).
Interactive logon	Signing in as a person would: at the console, through Remote Desktop, or through a remote support tool. A service account must not be able to.
Vault	Where shared, service and break-glass credentials are kept: a password manager or vault that records who opened which credential and when, open only to named administrators. A break-glass credential is also sealed in a safe.
Rotation	Changing a credential: a new password, secret or key, with the old one no longer working.
Phishing-resistant sign-in	A sign-in method that a fake sign-in page cannot capture and replay, because it proves possession of a key bound to the real site: a security key, a passkey on a managed device, or a certificate on a smart card or managed device (PA-05).
Rotation status	In date: the next change is after the as-at date. Due soon: within the warning days. Overdue: the next change date has passed. Not a shared credential: a personal account, whose holder changes the password, not counted in PAM-04.
(calc)	A column or cell the workbook calculates. Do not type or paste over it.
EXAMPLE	A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, as at 30 Sep 2026. Delete before use.

List every account whose password never expires, that runs a service or scheduled task on any server, or that sits in an administrator group, and compare the list with the inventory.

Name an owner

Ask the system owners and the suppliers. Assign an interim owner within [[5]] working days under PA-01, or disable it. An account with no permanent owner within [[30]] days is disabled, with the date, and deleted [[90]] days later if nothing breaks (PA-11).

Stop interactive logon

Deny console, Remote Desktop and remote support sign-in by policy. If people have been signing in with it, give them named accounts first (PA-02, PA-15).

Change and store the credential

Move it to a managed service account where the platform allows; otherwise change the password in a change window and put it in the vault (PA-10).

Cut its rights

Take it out of any group it does not need, and out of any tier above the systems it runs on (SR-5).

An alert on any interactive sign-in by a service account goes to the session reviewer (SQ-5).

Framework references

These references indicate relevance only and do not reproduce the text of any standard.

Framework	Reference	Supported by
ISO/IEC 27001:2022	Annex A 8.2 — Privileged access rights	Inventory: every privileged account with its owner, tier and rights; the Rights check against standing rights
ISO/IEC 27001:2022	Annex A 5.16 — Identity management	Inventory and Discovery: the full life of each identity, from finding and claiming it to its removal
NIST CSF 2.0	PR.AA-01 — “Identities and credentials for authorized users, services, and hardware are managed by the organization”	The whole inventory: identities and credentials for people, services and suppliers managed, with rotation
NIS2 — Directive (EU) 2022/2555	Article 21(2)(i) — “human resources security, access control policies and asset management”	The inventory as part of the access control policy and asset management
NIS2 — Implementing Regulation (EU) 2024/2690	Article 1 — lays down the technical and methodological requirements of the Article 21(2) measures, and further specifies when an incident is significant, for DNS service providers, TLD name registries, cloud computing, data centre and content delivery network providers, managed service and managed security service providers, providers of online marketplaces, online search engines and social networking services platforms, and trust service providers	The Implementing Regulation binds only the digital providers its Article 1 names; for others it shows what the regulator expects
NIS2 — Implementing Regulation (EU) 2024/2690	Annex, point 11.3.1 — “The relevant entities shall maintain policies for management of privileged accounts and system administration accounts as part of the access control policy referred to in point 11.1.”	The inventory as the record of the policy for privileged and system administration accounts
NIS2 — Implementing Regulation (EU) 2024/2690	Annex, point 11.6.2(c) — “require the change of authentication credentials initially, at predefined intervals and upon suspicion that the credentials were compromised”	Account types: rotation at set intervals; Inventory: the next change and its status; changed at once on suspicion
DORA — Regulation (EU) 2022/2554	Article 9(4)(c) — policies that limit access to information and ICT assets to what is required for legitimate and approved functions, with controls that ensure sound administration of access rights	The inventory supports sound administration of access rights (financial entities)
DORA — Delegated Regulation (EU) 2024/1774	Article 21(c) — user accountability: generic and shared accounts limited, and users identifiable for their actions	Removed on, and the removal times on Account types: access withdrawn without undue delay
ISO/IEC 27001:2022	Annex A 5.17 — Authentication information	Inventory: where each shared, service and break-glass credential is kept, and when it was last changed

ISO/IEC 27001 references name the clause or control this document relates to. They do not say that meeting it meets any other framework's requirement.