DP005Privileged access management

The separation, brokering, and time-bounding of access that exceeds ordinary entitlement.

Pillar: DP | Data and asset protection
Sources cited: 12
Added: 30 AUGUST 2026
Updated: 5 OCTOBER 2026

Control	Jurisdiction	Source	What it establishes	Prerequisite or recommendation
DP005/EUMandatory	European Union	Commission Implementing Regulation (EU) 2024/2690European Commission · read 29 Aug 2026	What the directive’s categories hold, in an annex setting out asset classification, the inventory, access control, privileged accounts, and removable media as requirements rather than as headings.	For the digital infrastructure and service providers it reaches, privileged and system administration accounts carry policies of their own, strong identification and authentication among them, and the systems used to administer are kept for administration and separated from everything else.
DP005/HRMandatory	Croatia	Uredba o kibernetičkoj sigurnostiVlada Republike Hrvatske · read 5 Oct 2026	For key and important entities, that candidates are checked before hiring according to the significance of the post, that a record is kept of every login and activity on critical systems for a forensic trail with at least the last 90 days of logs, synchronized time, and named log types, that security-relevant events are copied to a central store within 24 hours with anomaly detection and, where possible, an administrator other than the source system’s, that an owner approves the assignment of access rights and the approval is recorded, that privileged and administrator accounts follow written rules (dedicated accounts, individualized and limited privileges, use only for administration, strong authentication), that user and entity behaviour analytics is in the catalogue, and that a significant incident is notified in an early warning within 24 hours and an initial notification within 72 hours.	For key and important entities, privileged and administrator accounts follow written rules: dedicated accounts used only for administration, individualized and limited administrative privileges, use of privileged accounts only to connect to administration systems, and strong authentication such as multi-factor.
DP005/HUMandatory	Hungary	7/2024. (VI. 24.) MK rendelet a biztonsági osztályba sorolás követelményeiről, valamint az egyes biztonsági osztályok esetében alkalmazandó konkrét védelmi intézkedésekről, 2. mellékletMiniszterelnöki Kabinetiroda (the minister responsible for informatics) · read 5 Oct 2026	That an insider threat program with a multidisciplinary team handling insider security events is in the catalogue and is marked for none of the three classes; that awareness training on recognizing and reporting potential signs of insider threats is required in all three classes; that a risk designation of every position with screening criteria, screening of persons before access and re-screening on change of authorization or position or periodically, and a termination process that disables access within a defined time, revokes all credentials and authorizations, holds an exit interview on information security, and retrieves security assets are required in all three classes; and that the periodic review of privileges and the logging of privileged functions are required in the “jelentős” and “magas” classes.	For systems in the “jelentős” and “magas” classes, the system logs the execution of privileged functions.
DP005/ITMandatory	Italy	Determinazione ACN n. 379907 del 18 dicembre 2025Agenzia per la cybersicurezza nazionale · read 29 Aug 2026	The baseline security measures an Italian NIS subject has to adopt, among them the recording of remote and administrative access and its central retention, the detection of privilege abuse, and the vetting of the people admitted to the systems that matter.	For a subject in the national NIS register, every account is inventoried and approved by someone inside the organization, those with administrative privileges and those used for remote access included, and accounts are individual to a user unless there is a documented technical reason otherwise. A system administrator’s privileged and unprivileged accounts are to be completely distinct, and to carry different credentials.
DP005/PTMandatory	Portugal	Regulamento n.º 756/2026, Regulamento do Regime Jurídico da CibersegurançaCentro Nacional de Cibersegurança · read 5 Oct 2026	For entities in scope, that HR processes, selection, hiring, position categorization, and termination, are assessed against the entity’s cybersecurity requirements, that identities and credentials are issued, managed, verified, revoked, and audited, that access follows need to know and least privilege, that privileged passwords sit in a password manager and remote and privileged access carries multi-factor authentication, that logs are collected, stored, protected, and reviewed regularly, their retention set by risk and proportionality, failures in log processing raising alerts and critical systems’ logs stored on an autonomous system, that internal and external threats, intentional or accidental, are identified, that all staff receive awareness and training under a measured plan which includes awareness of internal threats, and that a significant incident is notified through the CNCS platform in an initial notification, an end-of-impact notification, and a final or interim report.	For entities in scope, passwords for privileged access are held in a password management solution, and remote and privileged accounts carry multi-factor authentication.
DP005/ESMandatory	Spain	Real Decreto 311/2022, Esquema Nacional de SeguridadGobierno de España · read 29 Aug 2026	The security measures a Spanish public sector body has to apply, graded by category, among them the concurrence of two people on critical tasks so that no single authorized individual can abuse their rights, an access control on the activity records themselves, and the recording of evidence where an incident may end in disciplinary action.	Development and operation are not to fall to the same person, nor are authorizing a use and controlling it. At the high category the same person may not hold configuration and maintenance together, and auditing or supervision may not be combined with any other function at all. Accounts carrying audit privileges are strictly controlled and personal to their holder, and the system’s security information is reachable only by the authorized administrators.
DP005/SEMandatory	Sweden	MSBFS 2020:7, föreskrifter om säkerhetsåtgärder i informationssystem för statliga myndigheterMyndigheten för samhällsskydd och beredskap · read 5 Oct 2026	For state authorities, that only authorized users and systems reach the IT environment and that no digital identity has more access than it needs, that administrative identities are used for administration only and assigned restrictively, that security logs record failed access attempts, configuration changes, changes of privileges, and access to protected information, and that the logs are analysed to detect and handle incidents and deviations.	For state authorities, identities that give administrative privileges are used for administration only and assigned restrictively.
Recommended	Francewhere written	Guide d'hygiène informatiqueAgence nationale de la sécurité des systèmes d'information · read 29 Aug 2026	Forty two measures at a standard and a reinforced level, among them the joining, leaving, and function change procedures written with the human resources function, and a minimum retention of one year for security critical events.	An exhaustive inventory of the privileged accounts is kept current, and reviewed periodically to make sure access to sensitive items is held, the working directories and the mailboxes of senior managers named among them. The review is also what removes the access left behind by a departure. A simple naming convention for service and administration accounts is wanted, because it makes both the review and the detection of an intrusion easier.
Recommended	Germanywhere written	IT-Grundschutz-Kompendium, Edition 2023Bundesamt für Sicherheit in der Informationstechnik · read 29 Aug 2026	What the German federal authority holds to be the state of the art, in numbered requirements, among them the checking of a candidate’s own account of themselves, a logging infrastructure the administrators who run it cannot alter, a regular audit of the detection systems against the state they are supposed to be in, and how evidence is secured.	An administrative activity should be one that two people have to carry out together. Where multi-factor authentication is used the factors are split between the two of them, and where a password is used it is divided in two and each of them holds a half. This sits at the grade the compendium keeps for a raised protection need.
Recommended	Greecewhere written	Οδηγός για τη Συμμόρφωση των Επιχειρήσεων με τον Ν. 5160/2024 και την Οδηγία NIS2ΣΕΒ (Hellenic Federation of Enterprises), with material from the Εθνική Αρχή Κυβερνοασφάλειας · read 5 Oct 2026	That the guide proposes ten procedures for compliance with Law 5160/2024, that under access control and account management it names role-based access on least privilege, multi-factor authentication for critical systems, logging of all accesses and actions, protection of service and privileged accounts by privileged access management, access reviews, and that the policies reach internal and external personnel across the whole access lifecycle.	Service and privileged accounts, administrators among them, are protected by privileged access management, and all accesses and actions are logged.
Recommended	Irelandwhere written	Cyber Security Baseline Standards, Revision 1National Cyber Security Centre and Department of the Environment, Climate and Communications · read 5 Oct 2026	For Public Service Bodies, that an access control policy on least privilege is defined and communicated, that a joiner, mover, leaver policy revokes access no longer required, that user permissions are reviewed monthly and on role change and privileged accounts on a defined schedule, that logging is enabled with a monitoring capability able to tie a user to suspicious activity, and that awareness training is mandatory for all staff.	For Public Service Bodies, the granting of highly privileged rights is strictly controlled and their ongoing need reviewed regularly, administrative accounts are separated from user accounts, and a secure listing of users with administrative privileges is maintained.
Recommended	Netherlandswhere written	Baseline Informatiebeveiliging Overheid 2, versie 1.3Nederlandse overheid · read 29 Aug 2026	The government measures Dutch public bodies add on top of the two information security standards, among them a screening policy, a detection use case named in the text, and a log retention set against the scenario that an attacker has been inside for a long time.	Only authorized personnel reach the system utilities, and only at the moments when reaching them is strictly necessary. Their use is logged, and the log is available for examination for half a year.