Performing Privileged Account Access Review

Overview

Privileged Account Access Review is a critical identity governance process that validates whether users with elevated permissions still require their access. This review covers domain admins, service accounts, database administrators, cloud IAM roles, and application-level privileged accounts. Regular access reviews are mandated by SOC 2, PCI DSS, HIPAA, and SOX compliance frameworks, typically required quarterly for high-privilege accounts.

When to Use

• When conducting security assessments that involve performing privileged account access review
• When following incident response procedures for related security events
• When performing scheduled security testing or auditing activities
• When validating security controls through hands-on testing

Prerequisites

• PAM solution deployed (CyberArk, BeyondTrust, Delinea, or equivalent)
• Identity governance platform (SailPoint, Saviynt, or equivalent)
• Complete inventory of privileged accounts across all platforms
• Defined access review policy with SLAs and escalation procedures
• Designated reviewers (account owners, managers, security team)

Core Concepts

Privileged Account Categories

Four-Pillar Review Framework

DISCOVER                    VALIDATE                    REMEDIATE                 MONITOR
    │                           │                           │                       │
    ├─ Enumerate all            ├─ Verify business          ├─ Remove excess        ├─ Continuous
    │  privileged accounts      │  justification            │  privileges           │  monitoring
    │                           │                           │                       │
    ├─ Identify orphaned        ├─ Confirm account          ├─ Disable orphaned     ├─ Anomaly
    │  accounts                 │  ownership                │  accounts             │  detection
    │                           │                           │                       │
    ├─ Map permissions to       ├─ Check compliance         ├─ Enforce password     ├─ Session
    │  business roles           │  with policies            │  rotation             │  recording
    │                           │                           │                       │
    └─ Classify by risk         └─ Review last usage        └─ Implement JIT        └─ Audit
       level                       and activity                access                  logging

Workflow

Step 1: Account Discovery and Inventory

Enumerate all privileged accounts across the environment:

Active Directory:

• Domain Admins, Enterprise Admins, Schema Admins groups
• Accounts with AdminCount=1 attribute
• Service accounts with SPN (Service Principal Names)
• Accounts with delegation rights (Unconstrained/Constrained)

Cloud Platforms:

• AWS: IAM users/roles with AdministratorAccess, PowerUserAccess, or iam:* permissions
• Azure: Global Administrator, Privileged Role Administrator, Security Administrator roles
• GCP: Owner, Editor roles at organization/project level

Databases:

• SQL Server: sysadmin, db_owner, securityadmin fixed roles
• Oracle: DBA, SYSDBA, SYSOPER privileges
• PostgreSQL: superuser, createrole, createdb attributes

Step 2: Establish Review Criteria

Each privileged account must be evaluated against:

1. Business Justification: Does the user's current role require this privilege?
2. Least Privilege: Can the task be performed with lower privileges?
3. Account Activity: Has the account been active in the last 90 days?
4. Compliance Status: Does the account meet password policy, MFA requirements?
5. Separation of Duties: Does the access create SoD conflicts?
6. Ownership: Is a responsible owner assigned and active?

Step 3: Conduct the Review

For each account, the designated reviewer must:

…