A privileged account can change settings, create users, read everyone's email, delete backups or move money. That makes it the account attackers want most. In many serious incidents, the first compromised account is an ordinary user, and the damage starts when the attacker reaches an administrator account. Privileged access management (PAM) is the set of practices that limits how many such accounts exist, who can use them, when, and how their use is watched.
Large enterprises buy dedicated PAM platforms. A small or mid-sized business can get most of the benefit with discipline and the tools it already owns. This guide shows how.
What counts as privileged access
Privileged access is broader than the IT administrator's login. Make a list that includes:
Cloud and directory admins
Global or tenant administrators for Microsoft 365, Google Workspace and identity systems, and root or owner accounts for cloud platforms.
Local administrator rights
Users who are administrators on their own computers, which lets malware they run do far more damage.
Business system admins
Administrators of accounting, payroll, banking portals, point of sale, ERP and customer databases. These can move money or export data.
Service and shared accounts
Accounts used by applications, scripts, scanners and backup software, and shared logins that several people know.
Vendor and MSP access
Remote access held by IT providers, software vendors and equipment service companies.
Infrastructure
Firewalls, routers, wireless controllers, backup consoles, security cameras and building systems.
The core practices
The Center for Internet Security (CIS) Controls and CISA's Cross-Sector Cybersecurity Performance Goals describe a consistent set of basics. All of the CIS safeguards below are in Implementation Group 1, the starting set CIS describes as essential cyber hygiene, except where noted.
| Practice | What the guidance says |
|---|---|
| Keep an inventory of accounts | CIS 5.1: maintain an inventory of user, administrator and service accounts and validate active accounts at least quarterly |
| Use dedicated admin accounts | CIS 5.4: restrict administrator privileges to dedicated administrator accounts and do browsing, email and productivity work from a standard account. CISA's goals likewise say no everyday user account should hold admin rights |
| Use unique passwords | CIS 5.2: unique passwords for all assets, with a best-practice minimum of 8 characters for accounts using MFA and 14 for accounts without it |
| Disable dormant accounts | CIS 5.3: delete or disable accounts after 45 days of inactivity, where supported |
| Inventory service accounts | CIS 5.5 (Implementation Group 2): record the owner, purpose and review date of each service account and review at least quarterly |
| Revoke access on departure | CISA: disable accounts and recover badges and tokens by the day an employee leaves |
Least privilege in practice
Least privilege means each person and system gets only the access the job requires, for only as long as it is needed.
- Remove local admin rights from everyday users. Handle software installs through IT or a managed tool instead.
- Use specific roles. Microsoft's guidance for small business admins recommends, for example, assigning User Administrator rather than Global Administrator to someone who only creates user accounts, and limiting the number of admin accounts overall.
- Keep admin sign-ins separate. Microsoft recommends that admins use a standard account for email and daily work and sign in to the admin account only when needed, closing unrelated browser sessions before admin work and signing out afterward.
- Grant access just in time where you can. Some identity platforms let an administrator activate a role for a limited period with approval, rather than holding it permanently.
- Split financial authority. In banking and accounting systems, require a second person to approve new payees, bank detail changes and large payments.
- End shared logins. Give each person an individual account so actions can be traced. Where a shared credential truly cannot be avoided, keep it in a password vault with access logging. See password management.
Strong authentication for privileged accounts
Multi-factor authentication is the minimum for any privileged account, and phishing-resistant methods such as passkeys, FIDO2 security keys or certificate-based authentication are stronger than codes sent by text or approved with a tap. CISA's performance goals rank hardware-based methods first and SMS last. Our multi-factor authentication guide explains the options.
Emergency access accounts
If your only global administrator is locked out, you can lose control of your own tenant. Microsoft recommends two or more emergency access ("break glass") accounts that are cloud-only, not tied to any individual or personal device, and protected with a phishing-resistant method different from the one your normal admins use. Microsoft also recommends alerting on every sign-in to these accounts and validating them at least every 90 days and after IT staff changes. Store their credentials securely in more than one location.
Control vendor and IT provider access
Managed service providers and software vendors often hold the most powerful access in a small business. NSA's top ten cloud security strategies include mitigating risks from managed service providers. Practical steps:
- Require each technician to use an individual, MFA-protected account rather than a shared vendor login.
- Grant the minimum roles needed, and remove access when a project ends.
- Make sure their activity is logged in your systems, not only theirs.
- Write notification duties into the contract: how quickly the provider must tell you about an incident affecting your environment.
- Review vendor accounts during your quarterly account review.
Our vendor security assessment guide has a fuller checklist.
Monitor and review
Privileged activity deserves closer watching than ordinary activity. Turn on alerts for new admin role assignments, sign-ins to emergency accounts, new mailbox forwarding rules, disabled security tools and mass deletions. Review the list of privileged accounts every quarter with the business owner, not just IT, and ask of each account: who uses it, is it still needed, and is it protected with strong MFA? Keep logs long enough to investigate an incident that is discovered weeks later.
A phased rollout for a small business
- Inventory. List every privileged account in cloud services, computers, business systems, network devices and vendor access.
- Quick wins. Turn on MFA for all admin accounts, remove unneeded admins and disable accounts of former employees and vendors.
- Separate accounts. Create dedicated admin accounts and remove local admin rights from everyday users.
- Emergency access. Set up and test break-glass accounts with alerts.
- Vault and review. Move remaining shared and service credentials into a password vault and start quarterly reviews.
Privileged access and your insurance
Cyber insurers pay close attention to privileged access because so many large losses involve it. Applications commonly ask whether MFA protects remote access and administrator accounts, whether admin accounts are separate from everyday accounts, and how backups are protected. Answer accurately; insurers rely on the application, and gaps between the answers and reality can create problems when a claim is made.
A cyber liability policy typically responds to the response costs, business interruption and liability that follow a covered intrusion. If a compromised account is used to redirect a payment, the loss may fall under a crime policy's funds transfer fraud coverage or a social engineering endorsement, or under a cyber policy's fraud coverage, depending on how the loss happened and how each policy is written. Those coverages often carry sublimits and verification conditions, so review them together.
When to call your broker
Call us before you complete or renew a cyber application, when you change IT providers, when you give a vendor administrative access to a core system, or right away if you see unexplained admin activity. As a broker, we compare options across the market and help you present your controls accurately to underwriters.
Sources
- Center for Internet Security — CIS Control 5: Account Management (Controls v8.1)
- CISA — Cross-Sector Cybersecurity Performance Goals
- Microsoft Learn — Admin account security in Microsoft 365 for business
- Microsoft Learn — Manage emergency access admin accounts
- National Security Agency — NSA Releases Top Ten Cloud Security Mitigation Strategies