Privileged Access & Administrative Identity — Project Plan
1. Overview
Reduce standing administrative privilege and evidence every elevation. Follows: Inventory → Elevate just-in-time → Reduce → Govern exceptions → Evidence.
2. Phases
Phase 0 — Charter and Alignment
Confirm scope, first role class, and evidence expectations.
Phase 1 — Inventory
Catalog standing administrative privilege by blast radius. Inventory non-human privileged identities and break-glass accounts.
Phase 2 — Just-in-Time Elevation
Introduce just-in-time elevation for one high-risk role class. Document and test break-glass.
Phase 3 — Reduction and Ownership
Reduce standing privilege for the targeted class. Assign owners to non-human privileged identities. Enforce separation of duties for one high-risk change class.
Phase 4 — Evidence
Emit provenance for elevations and high-risk changes. Transfer residual-risk ownership.
3. Success Measures
- Standing privilege inventoried.
- Just-in-time elevation used for one role class.
- Standing privilege reduced; residual documented.
- Break-glass identified and tested.
- Non-human identities have owners.
- Separation of duties enforced for one change class.
- Evidence available.
4. Immediate Next Actions
- Inventory standing administrative roles.
- Identify the first role class for just-in-time elevation.
- Locate break-glass accounts.
- Define separation-of-duties rules.
Project artifact. No internal architectural decision record identifiers.