Just-In-Time Access
What is Just-In-Time Access?
A privileged access management approach that grants users elevated permissions only when needed and for a limited duration, reducing standing privilege risk.
Terms that appear alongside just-in-time access
Each of these is named in at least one of the same controls as just-in-time access. The number is how many controls name both.
- access management 14 shared controls
- authentication 14 shared controls
- privileged access management 12 shared controls
- access control 11 shared controls
- multi factor authentication 10 shared controls
- nist 10 shared controls
- role based access control 9 shared controls
- privileged access management pam 7 shared controls
Frameworks that govern just-in-time access
What the standards actually require on just-in-time access
Requirements naming just-in-time access across 6 standards, quoted from the control text.
Design and operate OT network architecture per NIST SP 800-82 Rev 3 Chapter 6 (OT Security Architecture). Apply the Purdue Enterprise Reference Architecture as the foundational structure: Level 0 Physical Process + Level 1 Basic Control + Level 2 Area Supervis...
NISTSP82-3 · OT Network Architecture: Zoned Architecture, Conduits, Segmentation, and Defence-in-Depth →Use Privileged Identity Management (PIM) for just-in-time access elevation with approval workflows and time-bound activation.
PA-2 · Avoid standing access for user accounts and permissions →Move from role-based to attribute-based or just-in-time access with continuous authorization.
ZTMM-ID-4 · Access Management →34 CFR 99.31(a)(6)(iii)(D) safeguards requirement + the PTAC Best Practices Guidance + SPPO Guidance. The 2011 final rule explicitly requires APPROPRIATE METHODS to PROTECT PII when disclosed under the studies + audit + evaluation exceptions.
FERPA-Safeguards-PTAC · Data Security Safeguards for PII in Education Records (PTAC Best Practices, SPPO Guidance) →HKMA TM-G-1 Information Security Programme. Comprehensive technical + administrative + physical security controls. (1) INFORMATION SECURITY PROGRAMME (TM-G-1.6.1) - documented + Board-approved information security programme + governance + roles + ISMS-style al...
HKMA-TMG1-InfoSec-Access-PAM-Network-Crypto-DLP-Endpoint · TM-G-1 Information Security Programme + Access + PAM + Network + Crypto + DLP + Vulnerability + Endpoint →NSS-17 + NSS-42-G require comprehensive access control aligned with CSL: unique user identification + no shared accounts where feasible (emergency shared accounts logged + reviewed);
IAEA-NSS17-AccessControl-OT-IT-Authentication-Authorization · IAEA NSS-17 - Access Control + Authentication + Authorization + IAM + Privileged Access for OT and IT →Questions people ask about just-in-time access
What is Just-In-Time Access?
Why is Just-In-Time Access important for compliance?
Which compliance frameworks address Just-In-Time Access?
Where can I learn more about Just-In-Time Access?
See how Just-In-Time Access applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.