Scope - What This Guide Covers
This guide focuses on implementing Privileged Access Management (PAM) for federal agencies managing third-party vendor access and Non-Person Entity (NPE) accounts. It addresses control requirements from NIST SP 800-53 Rev 5 Access Control (AC) and Identification and Authentication (IA) families, with direct application to CMMC Level 2 practices AC.L2-3.1.1 through AC.L2-3.1.22.
You'll find requirement mappings, implementation steps for bastion host architectures, and automated credential rotation configurations. This guide doesn't cover general Identity, Credential, and Access Management (ICAM) strategy or Personal Identity Verification card management.
Key Concepts and Definitions
Privileged Access Management (PAM): Solutions that isolate, monitor, record, and audit privileged account sessions. PAM tools connect users to target systems without exposing elevated credentials.
Bastion Host: A hardened intermediary system that accepts connections from lower-privilege users and brokers access to protected resources. It authenticates users, applies session policies, and records all activity without revealing target system credentials.
Non-Person Entity (NPE) Account: Service accounts, application accounts, and automated process accounts requiring elevated privileges but not tied to individual users. These accounts present unique rotation and auditing challenges because they operate continuously without human intervention.
Privileged Session Recording: Complete capture of commands, keystrokes, and screen activity during elevated access sessions. Unlike basic Audit Logging, session recording creates a reviewable record of every action taken.
Requirements Breakdown
NIST SP 800-53 Rev 5 Controls
AC-2 (Account Management): Requires monitoring system accounts, including privileged accounts, and reviewing account activity. PAM directly satisfies AC-2(12) (Account Monitoring for Atypical Usage) and AC-2(13) (Disable Accounts for High-Risk Individuals).
AC-6 (Least Privilege): Mandates limiting authorized access to the minimum necessary. PAM implements AC-6(2) (Non-Privileged Access for Nonsecurity Functions) by brokering access without granting direct credential exposure.
IA-4 (Identifier Management): Covers unique identification of individuals, groups, and NPEs. Your PAM solution must track which human initiated each NPE session and correlate that activity to the individual's standard user account.
AU-2 (Audit Logging) and AU-3 (Content of Audit Records): Require comprehensive logging of privileged operations. Session recording goes beyond these baseline requirements, but you still need structured Audit Logging that export to your Security Information and Event Management system.
CMMC Level 2 Mappings
- AC.L2-3.1.5 (Prevent non-privileged users from executing privileged functions): Your bastion host enforces this by never exposing elevated credentials to contractor accounts.
- AC.L2-3.1.6 (Limit unsuccessful logon attempts): Configure on the bastion host, not the target systems contractors access.
- IA.L2-3.5.3 (Multifactor authentication for privileged accounts): Required on the bastion host login, even though contractors authenticate with standard credentials initially.
Implementation Guidance
Phase 1: Inventory Privileged Access Patterns
Document every scenario where third-party vendors or NPE accounts currently use elevated credentials. For each access pattern, record:
- Target system or database
- Required privilege level (read-only admin, full admin, database owner)
- Frequency and duration of access
- Current credential storage method
You'll discover contractors storing credentials in password managers, spreadsheets, or configuration files. You'll find NPE accounts with passwords that haven't changed in years because rotation would break automated processes.
Phase 2: Deploy Bastion Host Infrastructure
Set up a hardened jump server between your contractors and protected systems. Configure it to:
- Accept connections only from authenticated users with standard privileges
- Enforce multifactor authentication at the bastion layer (satisfies IA.L2-3.5.3)
- Broker connections to target systems using credentials the contractor never sees
- Record all session activity with keystroke and screen capture
Your bastion host becomes the single enforcement point for AC-6 least privilege requirements. Contractors log in with their own ICAM credentials, request access to a specific system, and the bastion establishes the connection using stored privileged credentials.
Phase 3: Configure Automated Credential Rotation
For NPE accounts, implement password rotation that doesn't require manual intervention. Your PAM solution should:
- Rotate NPE passwords on a schedule you define (daily, per-session, or on-demand)
- Update credentials simultaneously in the PAM vault and on target systems
- Test each rotated credential before marking it active
- Alert you when rotation fails due to locked accounts or policy conflicts
Consider per-session rotation for high-risk NPE accounts that access sensitive databases. The password changes immediately after each connection closes, rendering any captured credentials useless within minutes.
Phase 4: Implement Session Monitoring
Configure real-time alerting for suspicious patterns during privileged sessions:
- Commands that access unexpected file paths or databases
- Bulk data exports or unusual query patterns
- Access attempts outside approved maintenance windows
- Session durations that exceed typical baselines
You're not watching every session in real time, but your Security Operations Center needs alerts when activity deviates from established patterns. The U.S. government reports more than 28,500 cybersecurity incidents annually, with 45 percent resulting from indirect attacks. Your session monitoring must catch these indirect compromises before they escalate.
Common Pitfalls
Pitfall 1: Implementing PAM without updating vendor contracts. Your agreements with third-party contractors must prohibit direct credential sharing and require bastion host access. If your contract allows contractors to demand admin passwords, your PAM deployment won't stick.
Pitfall 2: Exempting "trusted" NPE accounts from rotation. That legacy application account with a static password is exactly what attackers hunt for. If rotation breaks the application, fix the application's authentication method, don't exempt the account.
Pitfall 3: Recording sessions without retention policies. Session recordings consume significant storage. Define retention periods based on data sensitivity and compliance requirements. You don't need three years of recordings for routine database maintenance, but you do need extended retention for sessions accessing Controlled Unclassified Information.
Pitfall 4: Failing to test bastion host failover. When your PAM infrastructure goes down, contractors can't do their jobs. You need redundant bastion hosts and documented emergency access procedures that don't bypass your entire control framework.
Pitfall 5: Treating PAM as a perimeter control. Your bastion host sits inside your network boundary. It's not replacing your firewall or VPN; it's adding a privilege enforcement layer after authentication. Don't confuse network access with privileged access.
Quick Reference Table
| Requirement | Control | PAM Implementation | Validation Method |
|---|---|---|---|
| Privileged account auditing | AC-2, AU-2 | Session recording with keystroke capture | Review recordings for sample contractor sessions |
| Least privilege enforcement | AC-6, AC-6(2) | Bastion host brokering without credential exposure | Attempt to extract target credentials from contractor workstation |
| NPE password rotation | IA-5(1) | Automated rotation on schedule or per-session | Verify password age in target system vs. PAM vault |
| Privileged MFA | IA.L2-3.5.3 | MFA required on bastion host login | Test bastion access with single factor only (should fail) |
| Anomaly detection | AC-2(12) | Real-time alerting on unusual commands or access patterns | Trigger test alert with unexpected database query |
| Account correlation | IA-4 | Link NPE sessions to initiating user account | Trace NPE database connection back to contractor identity |
Your PAM implementation directly addresses the attack surface created by third-party access. According to security executives surveyed, 85 percent recognize the need to protect their entire ecosystem beyond internal enterprise boundaries. This guide gives you the control mappings and implementation steps to make that protection operational, not aspirational.
