Privileged Access Workstation
What is Privileged Access Workstation?
A hardened and dedicated computing environment used exclusively for performing sensitive administrative tasks, isolated from general-purpose activities and the internet.
Terms that appear alongside privileged access workstation
Each of these is named in at least one of the same controls as privileged access workstation. The number is how many controls name both.
- isolation 3 shared controls
- zero trust 2 shared controls
- secure access service edge 2 shared controls
- access control 2 shared controls
- microsegmentation 2 shared controls
- authentication 2 shared controls
Frameworks that govern privileged access workstation
What the standards actually require on privileged access workstation
Requirements naming privileged access workstation across 5 standards, quoted from the control text.
Make operational changes through a formal change process; hold persistent secrets in hardware-protected central storage; grant privileged access only temporarily against a ticket, revoked automatically when it closes, from least-privilege role templates;
uk-telecommunications-security-act-2021::M11 · M11.01 to M11.42 Management plane: formal change, ticketed time-bound privileged access, break-glass controls, segregated management plane and hardened privileged access workstations →Provide secured, isolated workstations for sensitive roles such as administrators, developers and critical service operators, so administrative sessions do not originate from general-purpose endpoints.
ASBv3-PA-6 · Use privileged access workstations →Systems are managed so as to enable and maintain security. Partially achieved: administration is done only by authorised privileged users from devices separated from standard use, technical documentation and diagrams are regularly reviewed, and malware and una...
uk-ncsc-caf::B4.c · B4.c Secure management →ISMAP Identity and Access Management requires comprehensive IAM controls covering customer + CSP + administrative + service-to-service identities.
ISMAP-Identity-Access-MFA-Privileged-Federation-SSO-API-Tokens-CloudIAM-PIV-PASETO · ISMAP Identity and Access Management - Cloud IAM + Multi-Factor Authentication + Privileged Access + Federation/SSO + API Security + Access Tokens + My Number Card Integration + Government IAM →Apply D3FEND ISOLATE tactic to create logical or physical barriers in a system to reduce attack opportunities and impact. D3-EI Execution Isolation (D3-HBPI Hardware-based Process Isolation + D3-SCF System Call Filtering + D3-IBCA IO Channel Authentication + D...
MITRE-D3FEND-Isolate-Tactic-Execution-Network-Isolation-Sandboxing-Microsegmentation-DNS-Filtering · MITRE D3FEND Isolate Tactic + Execution + Network Isolation + Sandboxing + Microsegmentation + DNS Filtering →Questions people ask about privileged access workstation
What is Privileged Access Workstation?
Why is Privileged Access Workstation important for compliance?
Which compliance frameworks address Privileged Access Workstation?
Where can I learn more about Privileged Access Workstation?
See how Privileged Access Workstation applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.