Privileged Access Review Checklist Template

Owned by the IAM or security lead. Each platform’s extract is assigned to its system owner with a due date. Phase 1 also records whether a PAM vault or session recording is in use (Yes/No).

• Export privileged role holders from the directory — domain, enterprise and schema admins, cloud directory admin roles and anyone who can manage those groups
• Export cloud IAM admin roles — AWS, Azure and Google Cloud: owner, administrator and IAM-management roles, root or equivalent account users and access keys
• Export admin access to databases, network devices and hypervisors — DBA and owner rights, device admin accounts, local accounts and virtualisation consoles
• Export admin roles in SaaS consoles and the backup system — identity, email, HR, finance and the backup platform, which attackers target first
• Record how each extract was produced — who ran it, when and from which source, taken from the platform itself rather than from the vault alone
• Reconcile the extracts to one register — every account with a named human owner, platform, privilege level and type: person, service or break-glass

• Classify every assignment as standing or just-in-time — permanent role membership versus eligible access activated for a limited time
• Require a written reason for every standing assignment — anything that could be just-in-time is moved to it or recorded as a finding
• Check just-in-time activations against change and incident tickets — sample activations and confirm each had a reason and an approver
• Test for segregation of duties conflicts — for example the same person administering production and the backups that protect it, or approving their own privileged changes
• Flag privileged accounts with no use in the review period — unused rights are removed, not kept just in case

• Confirm admins use dedicated admin accounts — separate from the account they use for email, browsing and everyday work
• Confirm phishing-resistant MFA on every admin account — FIDO2 keys, passkeys, Windows Hello for Business or certificates, not SMS
• Find shared or generic admin accounts — each must be in the vault with individual check-out, or replaced by named accounts
• Check admin accounts of leavers and movers — disabled at the leaving date and removed from roles at the move date
• Check admin work happens from managed devices — privileged access workstations or a jump host where your policy requires one

Each service account is reviewed by its named owner. Any account without one is escalated to the system owner within the review period.

• Confirm every service account has a named owner and a stated purpose — accounts nobody claims are disabled after a fixed window
• Check interactive logon is blocked — or, where it is allowed for an exceptional reason, time-limited, approved and documented
• Check secret, password and key age against policy — and that none are hard-coded in scripts, configuration files or source code
• Review cloud access keys and workload identities — old keys rotated or removed, and machine identities used instead of long-lived keys where possible
• Reduce over-broad service account rights — domain admin or subscription owner granted for convenience is a finding

The vault and session tasks appear only when Phase 1 records that a PAM vault or session recording is in use (Yes/No).

• Test each break-glass account — sign in, confirm the alert fired to the right people and that credentials are stored as documented
• Explain every break-glass use since the last review — matched to an incident or test, with anything unexplained raised as a security incident
• Reconcile vault check-outs to tickets — a sample of privileged credential check-outs, each with a reason and a person
• Sample session recordings — confirm sessions on in-scope platforms are recorded and retained, and that a sample matches the approved work
• Confirm privileged activity is logged centrally — role changes, privilege elevation and admin sign-ins reaching the log platform

Appears only when any account in Phases 1–5 is marked modify or remove.

• Raise a ticket for every change — referencing this review so the trail runs both ways
• Remove or reduce access at the source — in the platform itself, not only in the identity provider group or the vault
• Rotate credentials the removed person could know — shared secrets, break-glass passwords and keys they had access to
• Attach proof of each change — a post-change export or screenshot
• Re-run the extract for affected platforms — the new list should no longer contain what was removed

System owners certify their platforms; the final task is an approval for the CISO or head of security. The cycle is not closed until it is Approved.

• Each system owner certifies their privileged accounts — access remains appropriate, with any exceptions listed; nobody certifies their own access
• Record approved exceptions — account, reason, compensating control, who accepted it and expiry date
• Assemble the evidence pack — extracts, the register, decisions, tickets, proof of removal and break-glass test results
• Feed findings back — into the joiner, mover and leaver process and the PAM roadmap, so the same gap is not found next quarter
• Approve the review — management acknowledgement that privileged access remains appropriate