Glossary term
PAM
Also: Privileged Access Management, Privileged Account Management
Software category for governing privileged access: vault, session management, just-in-time permissions, session recording, zero standing privilege. Mandatory stack under NIS2 and DORA for admin access.
Core functions: credential vault (rotating passwords), session proxy with recording, just-in-time provisioning (permission only for the time window), zero standing privilege (no permanent admin rights), approval workflows for elevation.
Market leaders: CyberArk, BeyondTrust, Delinea (formerly Thycotic/Centrify), One Identity Safeguard, ARCON. Cloud-native: HashiCorp Vault, AWS IAM Identity Center, Azure PIM, Google Cloud Privileged Access Manager.
In practice
Audit cases: BAIT BTO 6 requires separation of standard and admin accounts, documented assignment, regular recertification. NIS2 Art. 21 (i) requires personnel security and access control. DORA Art. 9 requires strict separation.
Related terms
IAM (Identity and Access Management)
The stack of systems that governs who has access to which systems under which conditions. IAM covers authentication, single sign-on, lifecycle management, access governance (IGA) and privileged access management (PAM), and is the most commonly breached control in enterprise environments.
IGA
Software category for identity governance: lifecycle management, role modelling, access recertification, segregation of duties, audit trail. Pulls the governance layer out of IAM.
Zero Trust
A security model built on the principle that no user, device or network location is trusted by default. Access is continuously verified against identity, device posture, context and policy, regardless of whether the request comes from inside or outside the corporate network.
Joiner-Mover-Leaver
Standard-Workflow im Identity-Lifecycle-Management: Onboarding (Joiner), Rollenwechsel inkl. Berechtigungs-Anpassung (Mover) und Offboarding mit Berechtigungs-Entzug (Leaver). Die Qualität des JML-Prozesses ist ein zentrales NIS2/DORA-Audit-Kriterium.
Passkeys
Phishing-resistant authentication credentials per WebAuthn/FIDO2 that keep private keys on the device and are unlocked biometrically or by PIN. Replace classic passwords and SMS OTP.
AI Act Conformity Assessment
Procedure to demonstrate that a high-risk AI system complies with the EU AI Act before being placed on the market or put into service. Mandatory for all Annex III high-risk systems from 2 December 2027 (postponed from the original 2 August 2026 by the Digital Omnibus, Regulation (EU) 2026/1744).
AI Act Risk Categories
Four-tier classification under the EU AI Act: prohibited (Art. 5), high-risk (Annex I/III), limited risk (Art. 50 transparency), minimal risk. Classification is the first duty; it must be documented and defensible.
Audit-ready decision
A decision whose record is structured, evidence-backed and stakeholder-signed to a level that a third-party auditor, a supervisor or a board reviewer can reconstruct the reasoning without interviewing the original team.