Skip to content

Privileged Access Management (PAM)

What is Privileged Access Management (PAM)?

A set of cybersecurity strategies and technologies for exerting control over elevated access and permissions for users, accounts, processes, and systems across an IT environment. PAM protects against credential theft and insider threats.

Information Security

Terms that appear alongside privileged access management (pam)

Each of these is named in at least one of the same controls as privileged access management (pam). The number is how many controls name both.

Frameworks that govern privileged access management (pam)

ISO 27001:2022View framework →NIST SP 800-53 Rev 5View framework →

What the standards actually require on privileged access management (pam)

Requirements naming privileged access management (pam) across 6 standards, quoted from the control text.

ITU-T X.805 - Security Architecture for End-to-End Communications2 controls

Security Dimension 1 Access Control per X.805 Clause 6.1: Access Control protects against unauthorized use of network resources. Access Control ensures that only authorized personnel or devices are allowed access to network elements + stored information + info...

X805-Dim1-Access-Control-RBAC-Authorization-Resources-Network-Elements-Services-Applications · ITU-T X.805 Security Dimension 1 - Access Control + Role-Based Access Control (RBAC) + Authorization + Resources + Network Elements + Services + Applications + Access Limitations + Authorized Personnel + Discretionary + Mandatory Access Control →
HKMA TM-G-11 control

HKMA TM-G-1 Information Security Programme. Comprehensive technical + administrative + physical security controls. (1) INFORMATION SECURITY PROGRAMME (TM-G-1.6.1) - documented + Board-approved information security programme + governance + roles + ISMS-style al...

HKMA-TMG1-InfoSec-Access-PAM-Network-Crypto-DLP-Endpoint · TM-G-1 Information Security Programme + Access + PAM + Network + Crypto + DLP + Vulnerability + Endpoint →
IACS Unified Requirements E26/E27 - Cyber Resilience of Ships and On-Board Systems1 control

UR E26 Goal 2 (Protect) requires access control + authentication + authorization mechanisms for all CBS. Unique user identification (no shared accounts where feasible); strong password policy (per NIST SP 800-63B + IEC 62443 + ship operational reality);

IACS-UR-E26-Protect-AccessControl-Authentication-IAM-Roles · IACS UR E26 Protect Goal - Access Control + Identity + Authentication + Authorization + User Management →
IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1)1 control

NSS-17 + NSS-42-G require comprehensive access control aligned with CSL: unique user identification + no shared accounts where feasible (emergency shared accounts logged + reviewed);

IAEA-NSS17-AccessControl-OT-IT-Authentication-Authorization · IAEA NSS-17 - Access Control + Authentication + Authorization + IAM + Privileged Access for OT and IT →
IMO Maritime Cybersecurity Guidelines (MSC-FAL.1/Circ.3/Rev.2)1 control

Protect is the second of five functional elements per MSC-FAL.1/Circ.3/Rev.2. Activities include: (1) Access Control - identity and access management for IT + OT systems + role-based access + least privilege + privileged access management (PAM) for OT engineer...

IMO-MSC-FAL-Protect-AccessControl-NetworkSegmentation-MalwareDefence-Patch-Awareness-DataSecurity · IMO MSC-FAL Protect Function - Access Control + Network Segmentation + Malware Defence + Patch Management + Awareness Training + Data Security + Crew BYOD + Removable Media →
ISMAP (Japan)1 control

ISMAP Identity and Access Management requires comprehensive IAM controls covering customer + CSP + administrative + service-to-service identities.

ISMAP-Identity-Access-MFA-Privileged-Federation-SSO-API-Tokens-CloudIAM-PIV-PASETO · ISMAP Identity and Access Management - Cloud IAM + Multi-Factor Authentication + Privileged Access + Federation/SSO + API Security + Access Tokens + My Number Card Integration + Government IAM →

Questions people ask about privileged access management (pam)

What is Privileged Access Management (PAM)?
A set of cybersecurity strategies and technologies for exerting control over elevated access and permissions for users, accounts, processes, and systems across an IT environment. PAM protects against credential theft and insider threats.
Why is Privileged Access Management (PAM) important for compliance?
Privileged Access Management (PAM) is a key concept in Information Security. Understanding privileged access management (pam) helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 686 frameworks with 311K cross-framework control mappings.
Which compliance frameworks address Privileged Access Management (PAM)?
Privileged Access Management (PAM) appears in the requirement text of ITU-T X.805 - Security Architecture for End-to-End Communications, HKMA TM-G-1, IACS Unified Requirements E26/E27 - Cyber Resilience of Ships and On-Board Systems, IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1), IMO Maritime Cybersecurity Guidelines (MSC-FAL.1/Circ.3/Rev.2). Across these standards we have identified 7 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Privileged Access Management (PAM)?
Explore our compliance framework pages to see how privileged access management (pam) applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 686 frameworks.

See how Privileged Access Management (PAM) applies across compliance frameworks

Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.