[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-8-2":3},{"item":4,"lessons":16,"controls":66,"related":94},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-8-2","Annex A 8.2","ISO\u002FIEC 27001:2022 Annex A 8.2: Privileged access rights",12,"International Organization for Standardization (ISO) and IEC","**What it asks for.** This control expects the allocation and use of privileged access rights to be restricted and managed. Administrative and other elevated rights should be granted only when needed and kept under tight control.\n\n**In practice.** Good practice includes an authorisation process for privileged accounts, separate admin accounts from everyday accounts, strong authentication, and time-limited or just-in-time elevation where possible. Use of privileged accounts is logged and reviewed, and rights are reviewed regularly and removed promptly when roles change. Auditors look for a list of privileged accounts with owners, approval records, review results and logs.\n\n**Common gaps.** Common gaps are shared admin accounts, standing privileges that are never removed, service accounts with excessive rights and no review of privileged activity.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"ai-agents-outpace-legacy-iam-the-non-human-identity-security-gap","AI Agents Outpace Legacy IAM: The Non-Human Identity Security Gap","2026-10-09T12:20:39.879+00:00",{"slug":23,"title":24,"published_at":25},"italian-dpa-finds-hospital-exposed-patient-records-through-weak-access-controls-and-logging","Italian DPA Finds Hospital Exposed Patient Records Through Weak Access Controls and Logging","2026-09-15T17:20:28.888+00:00",{"slug":27,"title":28,"published_at":29},"ghost-credentials-dormant-non-human-identities-create-hidden-cloud-attack-paths","Ghost Credentials: Dormant Non-Human Identities Create Hidden Cloud Attack Paths","2026-07-29T00:21:05.946+00:00",{"slug":31,"title":32,"published_at":33},"origin-energy-breach-exposes-900000-customers-personal-and-financial-data","Origin Energy Breach Exposes 900,000 Customers' Personal and Financial Data","2026-07-28T06:20:34.958+00:00",{"slug":35,"title":36,"published_at":37},"ai-agent-identity-sprawl-creates-governance-crisis","AI Agent Identity Sprawl Creates Governance Crisis","2026-07-10T16:21:42.939+00:00",{"slug":39,"title":40,"published_at":41},"ptsb-fined-277500-after-social-engineering-attacks-bypass-contact-centre-authentication","PTSB Fined €277,500 After Social Engineering Attacks Bypass Contact Centre Authentication","2026-07-06T14:20:24.268+00:00",{"slug":43,"title":44,"published_at":45},"insider-misuse-of-customer-data-earns-romanian-bank-gdpr-fine","Insider Misuse of Customer Data Earns Romanian Bank GDPR Fine","2026-07-03T16:20:23.913+00:00",{"slug":47,"title":48,"published_at":49},"unenforced-entra-id-controls-exposed-fifa-world-cup-streams-to-takeover","Unenforced Entra ID Controls Exposed FIFA World Cup Streams to Takeover","2026-06-18T20:21:05.399+00:00",{"slug":51,"title":52,"published_at":53},"saudi-government-ministries-suffer-major-data-breach","Saudi Government Ministries Suffer Major Data Breach","2026-06-08T23:20:16.283+00:00",{"slug":55,"title":56,"published_at":57},"caixabank-fined-400000-for-data-protection-process-failures","CaixaBank Fined €400,000 for Data Protection Process Failures","2026-06-08T14:20:37.127+00:00",{"slug":59,"title":60,"published_at":61},"french-national-id-agency-suffers-massive-data-breach-exposing-18m-citizens","French National ID Agency Suffers Massive Data Breach Exposing 18M Citizens","2026-04-14T17:08:58.056+00:00",{"slug":63,"title":64,"published_at":65},"major-ip-theft-exposes-critical-data-protection-failures-at-semiconductor-company","Major IP Theft Exposes Critical Data Protection Failures at Semiconductor Company","2026-04-08T18:09:20.785+00:00",[67,72,77,81,85,89],{"slug":68,"name":69,"problem":70,"stories":71},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",6,{"slug":73,"name":74,"problem":75,"stories":76},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",3,{"slug":78,"name":79,"problem":80,"stories":76},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",{"slug":82,"name":83,"problem":84,"stories":76},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":86,"name":87,"problem":88,"stories":76},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",{"slug":90,"name":91,"problem":92,"stories":93},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",2,[95,101,107,113,117,122,126,130],{"family":96,"item":97,"code":98,"title":99,"together":100},"cis","6","Control 6","Access Control Management",10,{"family":102,"item":103,"code":104,"title":105,"together":106},"nist-800-53","ac-2","AC-2","Account Management",9,{"family":108,"item":109,"code":110,"title":111,"together":112},"gdpr","32","Article 32","Security of processing",8,{"family":108,"item":114,"code":115,"title":116,"together":71},"25","Article 25","Data protection by design and by default",{"family":96,"item":118,"code":119,"title":120,"together":121},"3","Control 3","Data Protection",5,{"family":96,"item":123,"code":124,"title":125,"together":121},"13","Control 13","Network Monitoring and Defense",{"family":96,"item":127,"code":128,"title":105,"together":129},"5","Control 5",4,{"family":96,"item":131,"code":132,"title":133,"together":129},"8","Control 8","Audit Log Management"]