Policy Register
Every policy type · Access and identity

Privileged access management policy

How the accounts that can change the system are issued, separated from daily accounts, monitored, and taken back.

How the register reads it

Also calledPAM policy, administrator access
FamilyAccess and identity
Document typePolicy. The regimes ask for the content, not the label; a line pasted as a standard, procedure, plan or schedule is placed here with the label noted.
Folds intoThe regimes accept it folded into the access control policy; when neither is listed, the gap is counted once, under the parent.
Expected ownerThe head of IT operations.
Review cadenceAnnual (the register's default: the clauses say planned intervals and on significant change, and do not fix a period).
On the gap list whennever on its own: the register recognises it and names the clauses, but no ticked regime lists it as a separate document (its parent, access control policy, is).
TemplatePrivileged access management policy.

Which standards require it, and what each expects it to contain

1 requiring clauses, 1 regimes

Shown on a register for the regimes you tick; with none ticked, ISO 27001 is applied. Requirement text drawn from a human-verified compliance corpus under licence: the corpus statement of each clause, not the instrument verbatim.

ISO/IEC 27001:2022

ISO 27001 8.2 Privileged access rights

Restrict and manage the allocation and use of privileged access.

What the ISO 27002 guidance expects the document to say: Requires the allocation and use of privileged access rights to be restricted and actively managed.

Evidence an auditor accepts: The definition of what counts as privileged in each system, and the register of privileged accounts and their holders; authorisation records for each privileged allocation, showing the business justification and the approver; evidence of restriction, such as separate administrative accounts, multi factor authentication, session recording, vaulting or time bound elevation
Common gap: Outdated privileged account inventory
Source: ISO/IEC 27001:2022; guidance ISO/IEC 27002:2022

Do this for every document on your list

Paste the list and get this reading for every document at once, with the owner and cadence against each, the clauses quoted, and the documents the regimes expect that the list does not carry. Eight documents free, no account.

Build a register

Password and authentication standard · Asset management policy