Privileged Session Review Record
Documents periodic review of privileged activity logs, anomalies found and follow-up.
Available soon
- Format
- Word
- Size
- 59 KB
- Length
- 17 pages
- Version
- 2.0
- Updated
What's inside
What changed
- 2.0
Rewritten to the depth of the other CISO Times packs: the record now comes with its schedule, who may review, the log sources, the steps, what each of the seven questions looks for and field guidance; each part's fields carry hints; and two worked reviews are added, the first weekly Tier 0 review with its tier breach and the break-glass use reviewed late.
- 1.0
Published.
Preview
The document from section 1, as you will receive it. Highlighted [[text]] is for you to replace; shaded guidance boxes are for you to delete before approval. The cover and document control pages are in the file.
How to use this record
Use this record for every review of privileged activity: who used administrator rights, when, on which systems, and whether each use matches an approved ticket and the rules of the Privileged Access Standard. One record per review. A review is done by someone other than the administrators whose activity it covers. It is the evidence that privileged activity was reviewed at the cadence the standard sets, by someone with no administrator rights in the tier, and that anything unexplained was followed up (PA-09).
A review that finds nothing is a valid result, if the logs were complete. A review that could not see part of the period has not found nothing: the gap is recorded as a gap, and followed up.
Review schedule
Each scope, how often, and how soon after the period the review is due:
Scope | How often | Due | What is looked at |
|---|---|---|---|
SV-0 Tier 0 | Weekly | [[2]] working days after the period | Every privileged event: elevations, group and role changes, sign-ins by Tier 0 accounts, vault openings and changes to logging |
SV-1 Tier 1 | Monthly | [[5]] working days after the period | Every event without a matching ticket, and a sample of [[20]] elevations |
SV-2 Tier 2 | Quarterly | [[10]] working days after the period | A sample of [[20]] uses of local administrator passwords and service desk resets |
SV-S Supplier sessions | Monthly | [[5]] working days after the period | Every supplier session, against the approved windows, with the remote support tool's recording where one exists |
SV-B Break-glass use | Every use | [[1]] working day after the period | Every action the account took, against the declared reason |
Who reviews
The session reviewer [[e.g. Information Security Manager]]: reviews privileged sessions and runs the control review. Holds no administrator rights in the tier reviewed. Every break-glass use is reviewed by the Head of Information Security, from the log the account cannot change (PA-12).
The review keeps these duties apart, from the P02 conflict matrix:
Conflict | The two duties | How the review keeps them apart |
|---|---|---|
SOD-IT-03 | Administer a system with privileged access; and review a system's audit logs | Privileged activity logs go to a store administrators cannot change, and sessions are reviewed by someone with no administrator rights in that tier (PA-08, PA-09). |
SOD-SO-04 | Investigate security incidents; and administer a system with privileged access | When an incident involves an administrator's own systems, their activity is preserved and reviewed by someone else before they investigate (PA-09). |
Sources
Every privileged sign-in, elevation, change to a privileged group or role, and vault opening must be logged to a store administrators cannot change or delete, and kept for at least [[12]] months. Forward the directory's security events (for Windows: 4624 sign-in, 4672 special privileges assigned, 4728, 4732 and 4756 group membership added), the cloud tenant's audit and sign-in logs and servers' administrator command logs to the central log store the monitoring provider keeps.
A saved search per tier over the forwarded logs, run by the reviewer at the cadence set, compared with the ticket list. Supplier sessions are recorded by the remote support tool where it can.
Steps
Step | What to do | Who | When |
|---|---|---|---|
S1 | Confirm you hold no administrator rights in the tier under review. If you do, pass the review to someone who does not. | Session reviewer | Before starting |
S2 | Take the logs for the period from the central log store, and the list of tickets for privileged work in the same period. Note any source that is missing or incomplete. | Session reviewer | First working day after the period |
S3 | List every elevation, and every privileged event the scope requires, and match each to its ticket: account, system, rights, window and approver. | Session reviewer | Within the due time |
S4 | Answer the seven questions, each Yes or No, with the evidence. | Session reviewer | Within the due time |
S5 | Record each anomaly in Part C, with what the logs show and what was approved. Contain at once anything that looks like a compromise, and report it as an incident. | Session reviewer; Head of IT | As soon as it is found |
S6 | Agree each follow-up action with an owner and a date, and raise a finding where a control failed. | Session reviewer; Head of IT | Within the due time |
S7 | Complete Part D and send the record to the Head of Information Security; a review with an open finding goes with it. | Session reviewer | By the due date |
Reading the seven questions
Read each question literally. A Yes to something that should not happen, or a No to a match that should exist, is an anomaly for Part C. A question about whether an event happened, such as a reset or a break-glass sign-in, is answered No when none happened; that is not a failed control.
Question | A finding looks like | Where to look |
|---|---|---|
SQ-1 Does every elevation match an approved ticket, within its time and scope? (PA-07) | An elevation with no ticket, a window longer than approved, rights or systems beyond the ticket, or an approver who is the account's holder. | Group or role membership changes in the directory and cloud tenant logs, against the ticket list. |
SQ-2 Was any privileged right granted or used outside an elevation? (PA-06) | A privileged right used by an account with no active elevation, or a right added outside the just-in-time route. | Privileged sign-ins and special privileges assigned, against the elevation windows. |
SQ-3 Did any administrator account sign in outside its tier, or to email or the web? (PA-13) | An administrator account signing in to a system of another tier, or to email or a website that is not an administration portal. | Sign-in logs by account and target system, against the tier of each system. |
SQ-4 Was any break-glass account used, and was the use declared? (PA-12) | A break-glass sign-in that nobody declared, or one whose alert did not fire. | Sign-ins by the break-glass accounts, and the alert log. |
SQ-5 Did any service account sign in interactively? (PA-11) | A service account signing in at the console, by Remote Desktop or through a remote support tool. | Interactive sign-in events by service accounts; the remote support tool's session list. |
SQ-6 Was logging stopped, cleared or changed? (PA-08) | Logging stopped, cleared or its settings changed, or a gap in the logs nobody can explain. | Audit policy changes, log-cleared events, and the log store's own record of gaps. |
SQ-7 Was any privileged password or second factor reset, and did it follow PA-17? (PA-17) | A privileged password or second factor reset without the face-to-face or video check, the call back and a second administrator. | Reset events, against the reset tickets. |
Sampling
Tier 0 and break-glass reviews look at every event. The Tier 1 and Tier 2 reviews take a sample of [[20]], and the Tier 1 review also looks at every event without a matching ticket, whatever the sample. Choose the sample before looking at the events: every n-th elevation in the ticket list, or a random draw recorded in Part A. A sample picked after reading the logs tests nothing.
Where the sample finds an anomaly, widen it: review every event of the same account, system or kind in the period, and record the wider scope in Part A.
Escalating what the review finds
The review finds | What happens | Who is told |
|---|---|---|
Signs that an account or system may be compromised | Contain at once, and report it as a security incident under the Incident Triage & First-Hour Assessment Procedure. The review continues; the incident does not wait for it. | Head of Information Security, at once |
A tier breach | The tier breach steps of the Privileged Access Request, Elevation & Revocation Procedure, starting at once. | Head of IT and Head of Information Security, the same day |
An elevation with no ticket, or outside its window | An anomaly in Part C; the account's holder and the approver are asked to explain it, in writing. | Head of IT |
A missing or incomplete log source | Recorded as a coverage limit in Part D, with an action to restore it. The period is not recorded as clear. | Head of Information Security |
The same anomaly in two reviews running | A finding: the control meant to stop it is not working. | Head of Information Security, in the monthly report |
Field guidance
Field | A good answer | Common reason the review is sent back |
|---|---|---|
Independence | The reviewer's own administrator accounts listed, with none in the tier reviewed. | Reviewed by an administrator of the same tier. |
Log sources | Each source named, with the time the extract was taken. | "Logs checked" with no source. |
Missing sources | A gap named as a gap, with the action taken. | A missing log treated as proof that nothing happened. |
Answers | Yes or No, and the evidence for it. | A blank, or "OK". |
What the logs show | The event, its time and its system, as the log records it. | A summary with no time or system. |
Follow-up | One action, an owner and a date. | "Monitor" with no owner. |
Guidance — delete before approval
Keep the record with the extracts it was made from. An auditor will pick an elevation from the ticket system and ask to see it in the review, and the review in the logs.
The record
Guidance — delete before approval
Replace the placeholders with blank space when you adopt the record, or keep them as prompts. Keep the schedule and the seven questions the same as the Privileged Access Standard.
Part A: scope and sources
A Scope and sources | |||
Review reference | [[review reference]] | ||
Scope Tier 0, Tier 1, Tier 2, supplier sessions or a break-glass use | [[Tier 0, Tier 1, Tier 2, supplier sessions or a break-glass use]] | ||
Period first and last day | [[first and last day]] | ||
Due by working days after the period, as the schedule sets | [[working days after the period, as the schedule sets]] | ||
Reviewer | [[reviewer]] | ||
Independence no administrator rights in the tier reviewed | [[no administrator rights in the tier reviewed]] | ||
Systems and accounts covered | [[systems and accounts covered]] | ||
Log sources and when they were taken | [[log sources and when they were taken]] | ||
Missing or incomplete sources and what was done | [[and what was done]] | ||
Tickets and sample how the sample was chosen, where the scope samples | [[how the sample was chosen, where the scope samples]] | ||
Part B: the seven questions
Question | Rule | Answer | Evidence |
|---|---|---|---|
SQ-1 Does every elevation match an approved ticket, within its time and scope? | PA-07 | [[Yes / No]] | [[evidence; anomaly reference if any]] |
SQ-2 Was any privileged right granted or used outside an elevation? | PA-06 | [[Yes / No]] | [[evidence; anomaly reference if any]] |
SQ-3 Did any administrator account sign in outside its tier, or to email or the web? | PA-13 | [[Yes / No]] | [[evidence; anomaly reference if any]] |
SQ-4 Was any break-glass account used, and was the use declared? | PA-12 | [[Yes / No]] | [[evidence; anomaly reference if any]] |
SQ-5 Did any service account sign in interactively? | PA-11 | [[Yes / No]] | [[evidence; anomaly reference if any]] |
SQ-6 Was logging stopped, cleared or changed? | PA-08 | [[Yes / No]] | [[evidence; anomaly reference if any]] |
SQ-7 Was any privileged password or second factor reset, and did it follow PA-17? | PA-17 | [[Yes / No]] | [[evidence; anomaly reference if any]] |
Part C: each anomaly
One copy for each anomaly. Number them AN-01, AN-02 and so on.
C Anomaly | |||
Anomaly reference | [[anomaly reference]] | ||
Account, system and time | [[account, system and time]] | ||
Question and rule | [[question and rule]] | ||
What was approved ticket, window, task | [[ticket, window, task]] | ||
What the logs show | [[what the logs show]] | ||
Containment what was done at once | [[what was done at once]] | ||
Incident reference if compromise is suspected | [[if compromise is suspected]] | ||
Follow-up owner and due date | [[owner and due date]] | ||
Finding reference if a control failed | [[if a control failed]] | ||
Closed by whom, and when | [[by whom, and when]] | ||
Part D: completion
D Completion | |||
Events examined number, and the sample where one was taken | [[number, and the sample where one was taken]] | ||
Unexplained events | [[unexplained events]] | ||
Open findings | [[open findings]] | ||
Coverage limits missing logs or systems | [[missing logs or systems]] | ||
Escalated to whom, and when | [[whom, and when]] | ||
Conclusion | [[conclusion]] | ||
Completed on | [[completed on]] | ||
On time? | [[on time?]] | ||
Worked example: the first weekly Tier 0 review
EXAMPLE, not part of the record. The organisation is the one used throughout the pack: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders. It moved Tier 0 to security keys and just-in-time elevation on 21 Sep 2026, and started the weekly Tier 0 review with that week. Replace it with your own, or delete it from the adopted record.
A Scope and sources — EXAMPLE | |||
Review reference | SR-2026-W39 | ||
Scope Tier 0, Tier 1, Tier 2, supplier sessions or a break-glass use | Tier 0. Every privileged event: elevations, group and role changes, sign-ins by Tier 0 accounts, vault openings and changes to logging | ||
Period first and last day | 21 Sep 2026 to 27 Sep 2026 | ||
Due by working days after the period, as the schedule sets | 29 Sep 2026, 2 working days after the period | ||
Reviewer | Information Security Manager | ||
Independence no administrator rights in the tier reviewed | No Tier 0 administrator account; no membership of a Tier 0 group | ||
Systems and accounts covered | PS-01 Directory and its administrator groups, PS-02 Cloud identity tenant (email and office, P06 SUP-005), PS-03 Backup service console (P06 SUP-011) and PS-04 Endpoint protection and device management consoles | ||
Log sources and when they were taken | Directory security log, forwarded to the central log store; Cloud tenant audit and sign-in logs; Vault access log; Ticket list for the week. Taken on 28 Sep 2026 | ||
Missing or incomplete sources and what was done | None | ||
Tickets and sample how the sample was chosen, where the scope samples | Every Tier 0 event; no sample. 7 elevation tickets | ||
The elevations in the period, each matched to its ticket:
Elevation | Ticket | Account and right | Approved | Window | Result |
|---|---|---|---|---|---|
E-01 | IT-25102 | adm-jnovak Domain Admins | Mark Ellis, 5 minutes before | 09:10 to 11:05 on 21 Sep 2026; 1 hour 55 minutes | Matched |
E-02 | IT-25118 | adm-mellis Domain Admins | Ruth Okafor, 20 minutes before | 14:00 to 14:50 on 22 Sep 2026; 50 minutes | Matched |
E-03 | IT-25127 | adm-pshah Backup Operators | Mark Ellis, 15 minutes before | 10:00 to 13:30 on 23 Sep 2026; 3 hours 30 minutes | Matched |
E-04 | IT-25140 | adm-pshah Backup Operators | Mark Ellis, 10 minutes before | 09:30 to 12:30 on 24 Sep 2026; 3 hours | Matched; see AN-01 |
E-05 | IT-25144 | adm-jnovak Global Administrator | Mark Ellis, 10 minutes before | 15:00 to 15:40 on 24 Sep 2026; 40 minutes | Matched |
E-06 | IT-25151 | adm-mellis Global Administrator | Ruth Okafor, 10 minutes before | 11:00 to 11:30 on 25 Sep 2026; 30 minutes | Matched |
E-07 | IT-25163 | adm-jnovak Domain Admins | Mark Ellis, 5 minutes before | 02:20 to 04:05 on 26 Sep 2026; 1 hour 45 minutes | Matched |
Part B, answered:
Question | Rule | Answer | What it means |
|---|---|---|---|
SQ-1 Does every elevation match an approved ticket, within its time and scope? | PA-07 | Yes | All 7 elevations matched an approved ticket, within their window and the Tier 0 maximum, each approved by someone other than the account's holder. A match does not excuse what happened inside the window (SQ-3). |
SQ-2 Was any privileged right granted or used outside an elevation? | PA-06 | No | No privileged right was used outside an elevation in the period. |
SQ-3 Did any administrator account sign in outside its tier, or to email or the web? | PA-13 | Yes | adm-pshah signed in to FS-02, a Tier 1 file server, at 11:10 on 24 Sep while its Backup Operators elevation (E-04) was active. Anomaly AN-01; finding PF-03. |
SQ-4 Was any break-glass account used, and was the use declared? | PA-12 | No | No break-glass sign-in in the period. The last use, BGU-2026-01 on 5 Sep 2026, had its own review. |
SQ-5 Did any service account sign in interactively? | PA-11 | No | No interactive sign-in by the Tier 0 service account (svc-backup). |
SQ-6 Was logging stopped, cleared or changed? | PA-08 | No | No change to logging, and no gap in the period. |
SQ-7 Was any privileged password or second factor reset, and did it follow PA-17? | PA-17 | No | No privileged password or second-factor reset in the period. |
C Anomaly — EXAMPLE | |||
Anomaly reference | AN-01 | ||
Account, system and time | adm-pshah; FS-02, a Tier 1 file server (PS-08); 11:10 on 24 Sep 2026 | ||
Question and rule | SQ-3, PA-13 | ||
What was approved ticket, window, task | IT-25140, Backup Operators from 09:30 to 12:30: check the directory backup job after the restore test | ||
What the logs show | adm-pshah signed in to FS-02, a Tier 1 file server, at 11:10 on 24 Sep while its Backup Operators elevation (E-04) was active | ||
Containment what was done at once | Change the account's password and end its sessions, on 28 Sep 2026 | ||
Incident reference if compromise is suspected | None: no sign of compromise (checked 29 Sep 2026) | ||
Follow-up owner and due date | Split the account into a Tier 0 and a Tier 1 account, and deny Tier 0 groups sign-in on Tier 1 servers: Head of IT, due 28 Oct 2026 | ||
Finding reference if a control failed | PF-03: One account held Tier 0 rights (Backup Operators) and Tier 1 rights (Server Admins). With the Tier 0 elevation active, it signed in to a Tier 1 file server, where the Tier 0 credential could have been captured. | ||
Closed by whom, and when | Open at 30 Sep 2026 | ||
D Completion — EXAMPLE | |||
Events examined number, and the sample where one was taken | 7 elevations, and every Tier 0 sign-in, group change and vault opening in the period | ||
Unexplained events | None | ||
Open findings | PF-03 | ||
Coverage limits missing logs or systems | None | ||
Escalated to whom, and when | The Head of Information Security, with the record, on 28 Sep 2026 | ||
Conclusion | Tier 0 elevations are approved and time-limited as the standard sets. One account spans Tier 0 and Tier 1 and was used across them; until it is split, the weekly review checks it by name. | ||
Completed on | 28 Sep 2026 | ||
On time? | Yes: due 29 Sep 2026 | ||
Done on 28 Sep 2026, one working day before it was due: September's session reviews were 1 of 1 on time (PAM-07, on target). The weekly Tier 0 review began with the week of 21 Sep 2026; the first monthly Tier 1 and supplier reviews fall due in October. (EXAMPLE)
Worked example: a break-glass use reviewed late
EXAMPLE. BGU-2026-01: bg-cloud-01, 22:40 to 23:05 on 5 Sep 2026, used by Beth Owen, the managed IT provider's on-call engineer (P06 SUP-001). A sign-in policy change made at 22:10 required a compliant device that no administration device met, and locked every administrator out of the cloud tenant.
Item | What happened | Against the schedule |
|---|---|---|
Declared | By phone to Mark Ellis at 22:35 | Before the sign-in |
Alert | Received at 22:41 | Fired |
Credential changed | 7 Sep 2026 | 1 working day after the use |
Review due | 7 Sep 2026 | Break-glass use: [[1]] working day |
Reviewed | 25 Sep 2026, by Ruth Okafor | 14 working days late |
Outcome | Every action matched the reason: the policy was rolled back at 22:52 and nothing else was changed. | Nothing outside the declared reason |
The break-glass use on 5 Sep 2026 was declared and the credential changed on time, but nobody reviewed the session: the Head of IT thought the provider would, and the provider thought the Head of IT would. The use came before the standard was approved on 18 Sep 2026, so no record and no named reviewer existed yet. The control review on 24 Sep 2026 found it, and both actions were done the next day: review the session (Head of Information Security, 25 Sep 2026) and name the Head of Information Security as the reviewer of every use in the break-glass checklist (Head of IT, 25 Sep 2026). PAM-06 for the quarter is 0 of 1, outside tolerance (target: all, with no tolerance below it). (EXAMPLE)
When the review finds a tier breach
Every system must have a tier, and administrator accounts must follow the separation rules. An administrator account used outside its tier, or for email or browsing, is treated as a possible exposure of its credential. The Privileged Access Request, Elevation & Revocation Procedure sets the steps; in summary:
Step | What to do | When |
|---|---|---|
1 | Stop the use and end the account's sessions | At once |
2 | Change the account's password and revoke its sessions and tokens | At once for Tier 0; within [[1]] working day for Tier 1 and 2 |
3 | Check the system or mailbox it touched for signs of compromise; if there are any, it is an incident under the incident management pack (P09) | [[1]] working day |
4 | Review what the account did since the breach | [[1]] working day |
5 | Fix the cause: the right-tier account for the person, and a policy that blocks the sign-in next time | [[1]] month |
6 | Record it in the session review record, and as a finding if the policy failed | In the next review |
Record the breach in Part C, and the finding in Part D if a policy should have blocked the sign-in. In the EXAMPLE, AN-01 was contained the day it was found and the touched server checked the next day; the fix that stops it recurring, split the account into a Tier 0 and a Tier 1 account, and deny Tier 0 groups sign-in on Tier 1 servers, is due 28 Oct 2026.
Records and retention
Record | Kept |
|---|---|
This record, with the extracts and the ticket list it was made from | [[The period your records policy sets, and at least until the next audit]] |
The privileged logs themselves | At least [[12]] months, where administrators cannot change them (PA-08) |
Anomalies, findings and their follow-up | Until closed, and then with this record |
Measure. PAM-07, session reviews on time: session reviews due in the month that were done by their due date, out of all due. Break-glass reviews are counted in PAM-06.
Related documents
Document | Relationship |
|---|---|
Privileged Access Standard | The rules reviewed (PA-08, PA-09) and the schedule |
Privileged Access Request, Elevation & Revocation Procedure | The tickets each elevation is matched to, and the tier breach steps |
Privileged & Service Account Inventory | Every privileged account, its tier and its owner |
Break-Glass Account Control Checklist | The break-glass use and its own review |
Administrative Tier Model & Separation Matrix | The tier of every system, for SQ-3 |
Privileged Access Metrics Dashboard | Session reviews on time (PAM-07) and break-glass reviews (PAM-06) |
Access Review Methodology | The quarterly review of who holds privileged access, which this review does not replace (User Access Review pack) |
Incident Triage & First-Hour Assessment Procedure | An anomaly that looks like a compromise is reported as an incident (Security Incident Management pack) |
Adapting this template
Guidance — delete before approval
Small organisation: a monthly review of every privileged event can be enough while there are few administrators; keep the weekly Tier 0 review and the review of every break-glass use. If nobody inside is independent of the administrators, ask your security monitoring provider or an outside adviser to do the review and sign the record.
Regulated entity (NIS2, DORA): NIS2 Article 21(2)(i) expects access control to be applied and checked. A DORA financial entity limits access to approved functions (Article 9(4)(c)) and keeps users identifiable for their actions (Delegated Regulation (EU) 2024/1774, Article 21(c)); this record is the evidence that privileged actions were traced to a person and an approval.
IT run by a service provider: where the provider administers your systems, its sessions are in scope and are reviewed by your reviewer, never by the provider itself. Ask for the remote support tool's recordings and the provider's ticket references.
Delete this section before approval.
Framework references
These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard. ISO/IEC 27001 references name the clause or control this document relates to. They do not say that meeting it meets any other framework's requirement. Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2) and Implementing Regulation (EU) 2024/2690; Regulation (EU) 2022/2554 (DORA) and Delegated Regulation (EU) 2024/1774.
Framework | Reference | Supported by |
|---|---|---|
ISO/IEC 27001:2022 | Annex A 8.15 — Logging | Sources: privileged events logged where administrators cannot change them |
ISO/IEC 27001:2022 | Annex A 8.2 — Privileged access rights | Whole record: privileged access used only as approved |
ISO/IEC 27001:2022 | Annex A 8.16 — Monitoring activities | Review schedule and the seven questions |
NIST CSF 2.0 | DE.CM-03 — “Personnel activity and technology usage are monitored to find potentially adverse events” | Whole record: administrator activity monitored for adverse events |
NIST CSF 2.0 | PR.PS-04 — “Log records are generated and made available for continuous monitoring” | Sources: logs generated and available for review |
NIS2 — Directive (EU) 2022/2555 | Article 21(2)(i) — “human resources security, access control policies and asset management” | Whole record; regulated-entity tailoring |
DORA — Regulation (EU) 2022/2554 | Article 9(4)(c) — policies that limit access to information and ICT assets to what is required for legitimate and approved functions, with controls that ensure sound administration of access rights | Part B: use matched to approved functions |
DORA — Delegated Regulation (EU) 2024/1774 | Article 21(c) — user accountability: generic and shared accounts limited, and users identifiable for their actions | Part B and the elevation matching: each action traced to a person |
Definitions
Term | Meaning in this record |
|---|---|
Anomaly | An event the review cannot match to an approved ticket and the rules, or a Yes to a question about something that should not happen. |
Break-glass account | An emergency account used only when the normal administration route is unavailable, such as when every administrator is locked out. Sealed, watched, tested and reset after every use (PA-12). |
Elevation | One activation of just-in-time rights: who, which rights, which system, why, who approved, when it started and when it ended. |
Interactive logon | Signing in as a person would: at the console, through Remote Desktop, or through a remote support tool. A service account must not be able to. |
Privileged account | Any account that holds privileged access, standing or when elevated: a named administrator account, a supplier's administrator account, an application administrator role, a service account, a shared or built-in administrator account, or a break-glass account. |
Session review | A check, by someone other than the administrator, that privileged activity in a period matches approved tickets and the rules, with anything unexplained followed up (PA-09). |
Tier | A group of systems that give the same level of control over the organisation. An administrator account belongs to one tier (A08). |
Tier breach | An administrator account used outside its tier, or for email or browsing. Treated as a possible exposure of that account's credential (PA-13). |
Working day | Monday to Friday, excluding [[public holidays where you are]]. |