Protect · Established tier · Identity and Access

PR-01Privileged accounts are vaulted and attributable

Privileged accounts are inventoried, vaulted, rotated, attributable to a person and session-recorded.

Status

Gap

1 item contradicts the control.

Exposure

Critical

3 evidence items from 2 sources

CCSA · Protect

Below Foundational

Not blocking this domain's next tier.

What the evidence shows

23 service accounts with domain privilege sign in outside the vault, so their use is neither attributable nor recorded.

Remediation · Identity and Access

Onboard the 23 accounts to CyberArk with automatic rotation, or convert them to group-managed service accounts.

Every item is read-only, dated, hashed and re-runnable. This is what an examiner can test.

ev-pr01-1

23 domain-privileged service accounts sign in outside the vault

CyberArk Privilege Cloud · telemetry · collected 2 h ago (Oct 15, 2026 · 11:59 UTC) · limit 48 h

Contradicts

Query: GET /PasswordVault/API/DiscoveredAccounts?filter=privileged eq true
Identity: identity user assurance-ro (Auditors safe)
Collector: cyberark-collector 1.4.0
Window: 24 h
Records: 23
SHA-256: ea75add55610cbe9e7cad1fedf0f1ca0488efd80545d88f17c7eafe168919aff

ev-pr01-2

All 412 human administrators vaulted, with session recording

CyberArk Privilege Cloud · config · collected 2 h ago (Oct 15, 2026 · 11:59 UTC) · limit 48 h

Supports

ev-pr01-3

The remediation change is 12 days overdue

ServiceNow ITSM · ticket · collected 3 days ago (Oct 12, 2026 · 14:59 UTC) · limit 48 h

PartialStale