Quarter-Close Privileged Access Exception
At a mid-sized payments processor, quarter-end close begins in four days and a change freeze is in effect for the 12 systems in SOX scope. The privileged-access management (PAM) tool failed to provision a standing domain-admin role for a database administrator who must run reconciliation scripts on the payment ledger. The DBA asks for a 72-hour exception to the freeze and a shared break-glass account. Policy requires two-person approval for standing admin, MFA, and session recording, but the break-glass account bypasses the approval workflow and is not recorded. The DBA has 11 years' tenure and no prior violations; however, an audit three months ago found two orphaned admin accounts on the same ledger. The ledger supports $4.2B daily settlement. The service owner says without the scripts, close slips two days and creates a regulatory filing risk. The security team has one on-call reviewer available.
1. Decide whether to approve, deny, or modify the request. Justify the decision against the change freeze, least privilege, auditability, and quarter-close timing.
Read the worked answer
Decision: modify, not approve as requested. Deny the standing domain-admin role and the shared break-glass account. Approve a named, time-bound elevation for 72 hours scoped to the ledger reconciliation scripts, with manual two-person approval by the service owner and the security on-call reviewer. The business impact is real, but it does not justify bypassing auditability. The recent orphaned-account finding shows the ledger's privileged-access control is already weak; adding an unrecorded shared credential compounds that weakness. Break-glass is for emergencies, not planned quarter-close work. If PAM cannot provision in time, use an existing monitored admin account with just-in-time elevation and session recording through a jump host. Document the exception, scope, expiry, and approvers.
2. If access is granted, specify the minimum compensating controls and the evidence you would require before, during, and after the 72-hour window.
Read the worked answer
Minimum controls: named account only; no shared credentials; least-privilege role limited to the reconciliation scripts and ledger paths; MFA; session recording through a jump host; two-person approval; 72-hour automatic expiry; daily access review; alerting on privilege use and bulk file access; no ability to change audit settings. Before: ticket, approvals, script hash, scope statement, and confirmation that no standing admin is needed. During: PAM logs, command/session recordings, reviewed change tickets, and reconciliation output checks. After: proof of revocation, access review sign-off, log review for anomalous commands, and a root-cause ticket for the PAM provisioning failure. Require the service owner to confirm close completion and then remove access immediately.
3. The service owner escalates and insists on using the shared break-glass account to avoid delay. What do you do, and what do you document?
Read the worked answer
Hold the line: a planned quarter-close task does not meet the break-glass emergency threshold. Offer a manual approval bridge or an on-call reviewer to avoid delay. If the service owner still insists, require written risk acceptance from the CISO or CIO, not from the service owner alone, and add compensating monitoring: full session capture, real-time alerting, and a second reviewer. Do not silently authorize the shared account. Document the refusal, the alternatives offered, the names and times of approvers, the risk statement, and any residual monitoring. If the shared account is used anyway, treat it as a policy exception and initiate incident review, because unrecorded admin activity on a SOX-scoped ledger is itself a reportable control failure.