Privileged access management refers to processes and tools for controlling privileged accounts such as administrators, service accounts and emergency access. Instead of permanent rights, people receive permissions only when needed, time-limited and traceable.
Core principles
Least privilege: only the rights necessary for the task.
Just-in-time: rights are granted for a limited period and withdrawn afterwards (zero standing privileges).
Password vault: privileged credentials are stored encrypted and rotated after use.
Approval and justification: access to particularly critical systems requires authorisation.
Recording: sessions and changes are logged so they can be traced.
When PAM pays off
As soon as several administrators or external providers access servers and network devices, permanent full access is a risk. PAM also supports evidence obligations, for example under NIS2 or ISO 27001, because access is documented.
Starting in small steps
Inventory privileged accounts and remove surplus ones.
Introduce separate administrator accounts and enforce MFA.
PAM stands for privileged access management, the control and monitoring of privileged accounts such as administrators and service accounts.
What is just-in-time access?
Rights are granted only when needed and for a limited period, then removed automatically. Permanent administrator rights are eliminated.
Do small companies need PAM?
Not necessarily as a large platform, but the principles apply there too: separate administrator accounts, MFA, a password vault and no permanent full access.