Skip to content

Privileged Account

What is Privileged Account?

A user account with elevated permissions that provide administrative control over systems, databases, networks, or security configurations.

Information Security

Frameworks that govern privileged account

ISO 27001:2022View framework →NIST SP 800-53 Rev 5View framework →

What the standards actually require on privileged account

Requirements naming privileged account across 6 standards, quoted from the control text.

Australian Information Security Manual8 controls

Privileged user account and security group management events are centrally logged.

ISM-1650 · Logging privileged account and group management →
New Zealand Information Security Manual (NZISM)8 controls

Agencies must require two-factor or Multi-Factor Authentication before access to privileged accounts is allowed.

new-zealand-information-security-manual-nzism::16.4.37.C.02 · 16.4.37.C.02 Two-factor or MFA for privileged account access →
CMMC 2.04 controls

Require staff holding privileged accounts to use a non privileged account or role when performing work that does not need elevated rights.

AC.L2-3.1.6 · Non-Privileged Account Use →
NIST SP 800-53 Rev 54 controls

Restrict privileged accounts on the system to [Assignment: organization-defined personnel or roles].

NIST800-AC-6(5) · AC-6(5) Least Privilege | Privileged Accounts →
NIST SP 800-171 Rev 33 controls

Restrict privileged accounts to designated personnel; require non-privileged accounts for non-security functions.

03.01.06 · Least Privilege - Privileged Accounts →
NIST SP 800-53 Rev 5 HIGH3 controls

Restrict privileged accounts on the system to [Assignment: organization-defined personnel or roles].

nist-sp-800-53-revision-5-1-high::AC-6(5) · AC-6(5) Least Privilege | Privileged Accounts →

Questions people ask about privileged account

What is Privileged Account?
A user account with elevated permissions that provide administrative control over systems, databases, networks, or security configurations.
Why is Privileged Account important for compliance?
Privileged Account is a key concept in Information Security. Understanding privileged account helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 1,016 frameworks with 316K cross-framework control mappings.
Which compliance frameworks address Privileged Account?
Privileged Account appears in the requirement text of Australian Information Security Manual, New Zealand Information Security Manual (NZISM), CMMC 2.0, NIST SP 800-53 Rev 5, NIST SP 800-171 Rev 3. Across these standards we have identified 30 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Privileged Account?
Explore our compliance framework pages to see how privileged account applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 1,016 frameworks.

See how Privileged Account applies across compliance frameworks

Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.