privileged-access.xml 1 2027-01-04T08:00:00 08:00:00 17:00:00 480 2400 20 7 1 1 Standard 1 -1 1 0 2 1 08:00:0012:00:00 13:00:0017:00:00 3 1 08:00:0012:00:00 13:00:0017:00:00 4 1 08:00:0012:00:00 13:00:0017:00:00 5 1 08:00:0012:00:00 13:00:0017:00:00 6 1 08:00:0012:00:00 13:00:0017:00:00 7 0 1 1 Phase 0 — Inventory 1 1

1

2027-01-04T08:00:00 2027-01-29T17:00:00 2 2 A0.1 Active directory-role assignments inventoried and classified by tier 1.1 2 2027-01-04T08:00:00 2027-01-13T17:00:00 PT64H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b04-access/04-privileged-roles-and-tiers.md#the-programs-privilege-tiers 3 3 A0.2 Azure privileged role assignments and subscription owners inventoried 1.2 2 2027-01-04T08:00:00 2027-01-08T17:00:00 PT40H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b04-access/04-privileged-roles-and-tiers.md#azure-rbac 4 4 A0.3 App registrations, owners, credentials and granted permissions inventoried, read-only; automation on the protected permissions found 1.3 2 2027-01-04T08:00:00 2027-01-13T17:00:00 PT64H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b04-access/05-applications-and-workload-identities.md#a-read-only-inventory-to-start-from 5 5 A0.4 Existing emergency access accounts located and checked against the standard 1.4 2 2027-01-04T08:00:00 2027-01-06T17:00:00 PT24H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b04-access/04-privileged-roles-and-tiers.md#emergency-access-accounts 6 6 D-A1 Privilege tier model 1.5 2 2027-01-13T17:00:00 2027-01-13T17:00:00 PT0H0M0S 7 1 CISO Owner or approver: CISO Options: The program's four tiers as published (T0 control plane, T1 management plane, T2 scoped operations, read-only); the same boundaries with hour counts adapted to the agency's role inventory If decided late: No role's settings can be written, and the PIM build waits Source: ../books/b04-access/04-privileged-roles-and-tiers.md#the-programs-privilege-tiers 2 1 0 7 7 7 AG0 Gate 0 — Privilege inventoried 1.6 2 2027-01-13T17:00:00 2027-01-13T17:00:00 PT0H0M0S 7 1 CISO Owner or approver: CISO Criteria: Standing administrative privilege inventoried and classified by tier; app registrations listed with their owners and credentials; emergency access accounts located; tier model approved Source: ../books/b04-access/04-privileged-roles-and-tiers.md#the-programs-privilege-tiers 2 1 0 7 3 1 0 7 4 1 0 7 5 1 0 7 6 1 0 7 8 8 X-G0 Program G0 — Ready to Plan 1.7 2 2027-01-29T17:00:00 2027-01-29T17:00:00 PT0H0M0S 7 1 Steward (backup: executive sponsor; program) Owner or approver: Steward (backup: executive sponsor; program) If decided late: The foundation work can't start Source: program-master-schedule.md 4 2027-01-29T17:00:00 9 9 Phase 1 — Foundation: emergency access and the activation gate 2 1

1

2027-01-07T08:00:00 2027-03-01T17:00:00 10 10 D-A2 Emergency access credentials and custody 2.1 2 2027-01-06T17:00:00 2027-01-06T17:00:00 PT0H0M0S 7 1 CISO Owner or approver: CISO Options: Passkey (FIDO2) security keys or certificate-based authentication, different from the normal administrator methods; in either case retrieved only under dual custody by two senior administrators If decided late: Step 0 can't close, so no role can be made eligible and no approval switched on Source: ../books/b04-access/06-who-decides-access.md#emergency-access 5 1 0 7 11 11 A1.1 Two emergency accounts built to the standard, excluded by one group, alerted and tested 2.2 2 2027-02-01T08:00:00 2027-02-05T17:00:00 PT40H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b04-access/08-pim-self-request-with-approval.md#step-0-establish-emergency-access-accounts-first 10 1 0 7 8 1 0 7 12 12 A1.2 Phishing-resistant MFA registered for every eligible administrator, Tier 0 first (the program's G1 criterion covers Tier 0 administrators only) 2.3 2 2027-02-01T08:00:00 2027-02-12T17:00:00 PT80H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b04-access/08-pim-self-request-with-approval.md#prerequisites 8 1 0 7 13 13 A1.3 Audit and sign-in logs exported to the workspace at 365-day retention 2.4 2 2027-02-01T08:00:00 2027-02-05T17:00:00 PT40H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b04-access/08-pim-self-request-with-approval.md#step-9-export-audit-records-for-retention 8 1 0 7 14 14 D-A3 Approvers for PIM activation, by tier 2.5 2 2027-01-13T17:00:00 2027-01-13T17:00:00 PT0H0M0S 7 1 CISO Owner or approver: CISO Options: The security office as PIM-Approvers-T0, outside the Tier 0 population; a governed group outside the Tier 1 population as PIM-Approvers-T1; for each Tier 2 role, approval or a documented risk acceptance If decided late: Approval can't be switched on without the lockout risk, and the role settings wait Source: ../books/b04-access/08-pim-self-request-with-approval.md#approver-design-and-separation-of-duties 6 1 0 7 15 15 A1.4 Approver groups built, at least two approvers per tier 2.6 2 2027-02-01T08:00:00 2027-02-03T17:00:00 PT24H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b04-access/08-pim-self-request-with-approval.md#step-1-build-the-approver-groups 14 1 0 7 8 1 0 7 16 16 A1.5 Authentication context c1 and its policy PIM-Activation-c1 built and turned On 2.7 2 2027-02-15T08:00:00 2027-02-17T17:00:00 PT24H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b04-access/08-pim-self-request-with-approval.md#step-2-build-the-authentication-context-and-its-policy 11 1 0 7 12 1 0 7 17 17 D-A4 Write path for access as code 2.8 2 2027-01-29T17:00:00 2027-01-29T17:00:00 PT0H0M0S 7 1 Identity engineering Owner or approver: Identity engineering Options: Microsoft365DSC for every object class (the program's reference); Terraform azuread for the classes it covers, with Graph PowerShell for PIM role settings, access reviews and Lifecycle Workflows If decided late: Role settings can't be held as code, and the drift baseline waits Source: ../books/b04-access/10-access-as-code-and-evidence.md#coverage-and-the-programs-choice 8 1 0 7 18 18 D-A5 First role class under just-in-time elevation 2.9 2 2027-01-13T17:00:00 2027-01-13T17:00:00 PT0H0M0S 7 1 CISO Owner or approver: CISO Options: Tier 0 control-plane roles; Tier 1 management-plane roles If decided late: The pilot has no scope, and the program's Phase 2 PIM milestone waits Source: ../books/b00-orientation/06-the-project-portfolio.md#privileged-access-administrative-identity 7 1 0 7 19 19 D-A6 Access review cadence for privileged roles 2.10 2 2027-01-13T17:00:00 2027-01-13T17:00:00 PT0H0M0S 7 1 CISO Owner or approver: CISO Options: Monthly for Tier 0 and quarterly for every other privileged role (the program's design); another organization-defined frequency, which AC-6(7) leaves to the agency If decided late: Reviews can't be scheduled, and the pilot gate's first-review criterion fails Source: ../books/b04-access/08-pim-self-request-with-approval.md#step-8-access-reviews-of-eligibility 6 1 0 7 20 20 A1.6 Role settings for every tier written as code from Appendix B and reviewed 2.11 2 2027-02-18T08:00:00 2027-03-01T17:00:00 PT64H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b04-access/appendix-b-pim-role-settings.md#settings-common-to-every-role 17 1 0 7 15 1 0 7 16 1 0 7 21 21 AG1 Gate 1 — Foundation ready 2.12 2 2027-03-01T17:00:00 2027-03-01T17:00:00 PT0H0M0S 7 1 CISO Owner or approver: CISO Criteria: Emergency access accounts tested; PIM-Activation-c1 On; an approver group named on every role that requires approval; role settings in the repository and reviewed; logs exported beyond 30 days Source: ../books/b04-access/08-pim-self-request-with-approval.md#build 20 1 0 7 13 1 0 7 22 22 X-G1 Program G1 — Foundation Complete 2.13 2 2027-02-26T17:00:00 2027-02-26T17:00:00 PT0H0M0S 7 1 Steward (program) Owner or approver: Steward (program) If decided late: The pilot can't start Source: program-master-schedule.md 4 2027-02-26T17:00:00 11 1 0 7 12 1 0 7 23 23 Phase 2 — Just-in-time pilot for one role class 3 1

1

2027-03-01T08:00:00 2027-04-23T17:00:00 24 24 A2.1 Pilot class's role settings applied; PRV role-assignable groups hold the eligible assignments 3.1 2 2027-03-02T08:00:00 2027-03-08T17:00:00 PT40H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b04-access/04-privileged-roles-and-tiers.md#how-a-role-reaches-a-person 21 1 0 7 22 1 0 7 18 1 0 7 25 25 A2.2 Standing assignments in the pilot class converted: eligible first, activation confirmed, active removed 3.2 2 2027-03-09T08:00:00 2027-03-22T17:00:00 PT80H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b04-access/08-pim-self-request-with-approval.md#step-5-convert-standing-assignments-to-eligible 24 1 0 7 26 26 X-P25 PIM for every pilot administrator (program P2.5, M-026) 3.3 2 2027-03-19T17:00:00 2027-03-19T17:00:00 PT0H0M0S 7 1 Platform teams (program) Owner or approver: Platform teams (program) If decided late: Shown for reference: the program makes every role a pilot administrator holds eligible, which goes further than this plan's one pilot class (A2.2) Source: program-master-schedule.md 4 2027-03-19T17:00:00 27 27 A2.3 Protected actions with context c2 on the Conditional Access permissions 3.4 2 2027-03-09T08:00:00 2027-03-15T17:00:00 PT40H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b04-access/08-pim-self-request-with-approval.md#step-6-close-the-loop-with-protected-actions 24 1 0 7 4 1 0 7 28 28 A2.4 Notifications and PIM alerts routed; the assigned-outside-PIM alert reaches the SIEM 3.5 2 2027-03-09T08:00:00 2027-03-11T17:00:00 PT24H0M0S 7 0 Security operations Owner or approver: Security operations Source: ../books/b04-access/08-pim-self-request-with-approval.md#step-7-notifications-and-pim-alerts 24 1 0 7 29 29 A2.5 Administrator policies (CA003 to CA005, CA025 to CA027) in report-only, then piloted on the identity team 3.6 2 2027-03-01T08:00:00 2027-03-19T17:00:00 PT120H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b04-access/07-the-conditional-access-policy-library.md#wave-2-administrators 22 1 0 7 30 30 D-A7 PAW enforcement for the administrator persona 3.7 2 2027-03-19T17:00:00 2027-03-19T17:00:00 PT0H0M0S 7 1 CISO Owner or approver: CISO Options: Enforce CA004 and CA025 for every administrator; enforce with a time-bound exclusion group for administrators whose PAW isn't issued; keep report-only and fix the causes first If decided late: Privileged roles stay usable from any device, and the pilot gate waits Source: ../books/b04-access/04-privileged-roles-and-tiers.md#privileged-access-workstations 29 1 0 7 31 31 A2.6 Administrator policies enforced ring by ring, an emergency sign-in tested before and after 3.8 2 2027-03-22T08:00:00 2027-04-02T17:00:00 PT80H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b04-access/07-the-conditional-access-policy-library.md#rollout-from-report-only-to-enforcement 30 1 0 7 32 32 A2.7 First monthly review of Tier 0 eligibility and PRV-T0 membership closed 3.9 2 2027-03-23T08:00:00 2027-04-05T17:00:00 PT80H0M0S 7 0 Identity governance officer Owner or approver: Identity governance officer Source: ../books/b04-access/09-access-governance.md#cadence 25 1 0 7 19 1 0 7 33 33 A2.8 Validation test plan run for the pilot class 3.10 2 2027-04-05T08:00:00 2027-04-07T17:00:00 PT24H0M0S 7 0 ISSO Owner or approver: ISSO Source: ../books/b04-access/08-pim-self-request-with-approval.md#validation-test-plan 25 1 0 7 27 1 0 7 28 1 0 7 31 1 0 7 34 34 AG2 Gate 2 — Just-in-time in use for the pilot class 3.11 2 2027-04-07T17:00:00 2027-04-07T17:00:00 PT0H0M0S 7 1 CISO Owner or approver: CISO Criteria: Every human assignment in the pilot class eligible; only the emergency accounts and documented service principals standing; validation tests pass; the first review closed with removals applied; every elevation evidenced in the workspace Source: ../books/b04-access/08-pim-self-request-with-approval.md#assessment-evidence 32 1 0 7 33 1 0 7 35 35 X-G2 Program G2 — Pilot Clean 3.12 2 2027-04-23T17:00:00 2027-04-23T17:00:00 PT0H0M0S 7 1 Steward and executive sponsor (co-signed; program) Owner or approver: Steward and executive sponsor (co-signed; program) If decided late: The remaining tiers can't start Source: program-master-schedule.md 4 2027-04-23T17:00:00 34 1 0 7 36 36 Phase 3 — Every tier 4 1

1

2027-04-08T08:00:00 2027-09-10T17:00:00 37 37 A3.1 Remaining tiers converted to eligible, tier by tier 4.1 2 2027-04-26T08:00:00 2027-06-04T17:00:00 PT240H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b04-access/08-pim-self-request-with-approval.md#settings-by-tier 34 1 0 7 35 1 0 7 38 38 A3.2 Azure privileged roles eligible through PIM; three subscription owners at most 4.2 2 2027-05-03T08:00:00 2027-05-21T17:00:00 PT120H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b04-access/04-privileged-roles-and-tiers.md#azure-rbac 37 3 24000 7 39 39 A3.3 PRV group membership published as access packages with approval, expiry and review 4.3 2 2027-04-26T08:00:00 2027-05-14T17:00:00 PT120H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b04-access/04-privileged-roles-and-tiers.md#layer-1-who-may-ever-hold-the-role 34 1 0 7 35 1 0 7 40 40 A3.4 Non-human privileged identities: two named owners each, credentials off secrets, over-consented apps swept 4.4 2 2027-04-26T08:00:00 2027-06-18T17:00:00 PT320H0M0S 7 0 Identity governance officer Owner or approver: Identity governance officer Source: ../books/b04-access/05-applications-and-workload-identities.md#governing-app-registrations 34 1 0 7 35 1 0 7 41 41 A3.5 Help desk privileged access group narrowed to a custom assignment role 4.5 2 2027-06-07T08:00:00 2027-06-11T17:00:00 PT40H0M0S 7 0 Identity governance officer Owner or approver: Identity governance officer Source: ../books/b04-access/06-who-decides-access.md#what-each-entra-role-can-actually-do 37 1 0 7 42 42 A3.6 Change control in force: two people per change, a security approver for Tier 0 objects, drift every six hours 4.6 2 2027-04-08T08:00:00 2027-04-28T17:00:00 PT120H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b04-access/10-access-as-code-and-evidence.md#change-control 34 1 0 7 43 43 A3.7 First quarterly review cycle closed for Tier 1, Tier 2 and read-only roles 4.7 2 2027-06-07T08:00:00 2027-06-25T17:00:00 PT120H0M0S 7 0 Identity governance officer Owner or approver: Identity governance officer Source: ../books/b04-access/appendix-b-pim-role-settings.md#review-cadence-by-tier 37 1 0 7 39 1 0 7 44 44 AG3 Gate 3 — Every tier just-in-time 4.8 2 2027-06-25T17:00:00 2027-06-25T17:00:00 PT0H0M0S 7 1 CISO Owner or approver: CISO Criteria: Every human privileged assignment eligible; requester and approver distinct for Tier 0 changes; non-human privileged identities in scope have two named owners; reviews running on the approved cadence; a Tier 0 drift handled as an incident Source: ../books/b04-access/10-access-as-code-and-evidence.md#drift-detection-and-closure 38 1 0 7 40 1 0 7 41 1 0 7 42 1 0 7 43 1 0 7 45 45 X-G3 Program G3 — Rollout Complete 4.9 2 2027-09-10T17:00:00 2027-09-10T17:00:00 PT0H0M0S 7 1 Executive sponsor and steering committee (program) Owner or approver: Executive sponsor and steering committee (program) If decided late: The access-related Group Policy can't be retired Source: program-master-schedule.md 4 2027-09-10T17:00:00 46 46 Phase 4 — Evidence and residual risk 5 1

1

2027-09-13T08:00:00 2027-10-01T17:00:00 47 47 A4.1 Access-related GPO settings (smart-card logon, logon rights) retired where the library policy is enforced 5.1 2 2027-09-13T08:00:00 2027-09-24T17:00:00 PT80H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b04-access/07-the-conditional-access-policy-library.md#retiring-group-policy-with-the-library 45 1 0 7 31 1 0 7 48 48 A4.2 Residual standing privilege named in the system security plan; residual risk to the authorizing official 5.2 2 2027-09-27T08:00:00 2027-10-01T17:00:00 PT40H0M0S 7 0 ISSO Owner or approver: ISSO Source: ../books/b04-access/08-pim-self-request-with-approval.md#step-5-convert-standing-assignments-to-eligible 44 1 0 7 47 1 0 7 49 49 A4.3 Monthly evidence package assembled and its metrics signed off 5.3 2 2027-09-13T08:00:00 2027-09-24T17:00:00 PT80H0M0S 7 0 Identity governance officer Owner or approver: Identity governance officer Source: ../books/b04-access/10-access-as-code-and-evidence.md#the-evidence-package-for-a-period 42 1 0 7 45 1 0 7 50 50 AG4 Gate 4 — Residual privilege owned 5.4 2 2027-10-01T17:00:00 2027-10-01T17:00:00 PT0H0M0S 7 1 CISO Owner or approver: CISO Criteria: Residual standing privilege named with a rationale and accepted by the authorizing official; evidence for every elevation in the period; exception register current; the replaced access-related GPO settings retired Source: ../books/b04-access/10-access-as-code-and-evidence.md#what-the-assessor-reads 48 1 0 7 49 1 0 7