Privileged Access Management (PAM) is the set of controls that governs, monitors, and audits accounts with elevated permissions: system and database administrators, and the service accounts that can make sweeping changes across an environment. Because those accounts can do the most damage, they are the ones attackers want most.
A PAM platform enforces just-in-time access, granting elevated rights only when a task requires them and pulling them back the moment it is done, so standing privilege shrinks toward zero. It also records privileged sessions, rotates and vaults credentials automatically, and flags behavior that looks off, such as an admin signing in at an odd hour from an unfamiliar host. Where organizations stumble is leaving service accounts with static, shared passwords that never expire, since those quiet accounts are easy to forget and perfect for an attacker to hide behind while moving laterally.
How is privileged access management tested on the CISSP?
PAM falls squarely in Domain 5: Identity and Access Management. Candidates should explain how privileged controls limit lateral movement and enforce least privilege at the most sensitive tier of access. NIST defines account management controls in SP 800-53 Rev 5.
Related terms: Least Privilege, Role-Based Access Control