Quick Check: What's the immediate story?

• Briefly describe the audit finding that kicked this off (percent of orphaned accounts, sample systems called out, and who authored the finding).
• How urgent is this for your executive team and the board right now? Options: Critical — board-level mandate (90 days), High — senior leadership pressure, Medium — internal audit concern, Low — exploratory
• Who is officially the owner of the remediation initiative (title/team)? Select all that apply. Options: CISO, IAM program lead, Head of Internal Audit, IT Operations lead, Compliance, Business unit owner
• Which systems did the auditors explicitly cite in the report? Options: Mainframe (RACF), SWIFT operator IDs, Active Directory / Windows, Trading system service accounts, Linux/Unix, Cloud admin roles, SaaS apps, Other
• Who must sign off before procurement will release a purchase order? Options: CISO, Head of Procurement, Finance/Budget Owner, Internal Audit, Business Committee, Legal

If nothing changes, what breaks first?

• Is it plausible that a compromised privileged account could enable lateral movement into payment-processing within the 90‑day window? Options: Very plausible, Somewhat plausible, Unlikely, Unknown
• Which concrete failure scenarios keep you up at night (describe a plausible attack path or operational failure).
• Which consequences worry you most if an incident occurs in the privileged estate? Options: Regulatory consent order, Direct financial loss, Reputational damage, Operational outage (trading/wires), Litigation, Other
• How likely is the board to escalate to an external examiner or regulator if remediation slips past the deadline? Options: Almost certain, Possible, Unlikely, Not sure
• Which privileged identities are the highest priority to lock down first? Options: Domain admins, SWIFT operator IDs, Trading system service accounts, RACF profiles, Cloud root/admins, Shared service accounts

Who's in the foxhole with you?

• Who will be at the decision table for strategy and approvals (list people/roles and their authority level)?
• Which stakeholders would block a plan if they believe it risks trading or wire-transfer windows? Options: IT Operations, Trading Desk leadership, Business Unit Owners, CISO, Chief Risk Officer, Other
• Who owns auditor-facing evidence today (internal audit, IAM, compliance, or an external provider)? Options: Internal Audit, IAM team, Compliance, External Auditor/Consultant, Not defined
• How empowered is the IAM program lead to make configuration and connector decisions without executive escalation? Options: Full autonomy, Limited autonomy with checkpoints, Needs exec approval for major changes, Not sure
• How do your key stakeholder meetings run (frequency, decision authority, escalation path)?

Are you comfortable with the 90‑day sprint?

• Do you believe the 90‑day remediation mandate is achievable without unacceptable disruption? Options: Yes — achievable, Possibly with tradeoffs, No — unrealistic, Unsure
• What are the explicit success criteria for the 90‑day mandate (what must be true at day 90)?
• List all non‑disruption constraints (specific trading hours, settlement cutoffs, month‑end/quarter‑end blackouts).
• Which time windows are absolute no‑change periods for your environment? Options: Market open/close, End‑of‑day batch window, Month/Quarter close, High‑value settlement windows, Holiday trading periods, Other
• What rollback or contingency tolerance do you require if a cutover impacts users or processes? Options: Immediate automated rollback, Planned manual rollback window, Workaround acceptable for limited time, Zero tolerance — must not require rollback

Show me the truth: systems, identities, and evidence

• How complete is your authoritative inventory of privileged accounts across systems? Options: Complete and audited, Mostly complete, Fragmented across teams, No central inventory
• Which tools or artefacts currently track privileged credentials and their lifecycle? Options: PAM/vault, Spreadsheets, ITSM tickets, Homegrown DB, No tracking, Other
• How are sessions involving privileged accounts currently recorded and retained (if at all)? Options: Native session recording, SIEM logs only, Application logs, Manual evidence collection, Not recorded
• Give an example of examiner‑ready evidence you can produce today and how long it takes to generate.
• Which system connectors are missing, incomplete, or custom (select all that apply)? Options: RACF / z/OS, SWIFT interfaces, Active Directory, Cloud IAM (AWS/Azure/GCP), Trading platform APIs, Custom legacy apps, Other
• How long does it currently take to produce a full access recertification report (from request to auditor‑ready artifact)? Options: <1 day, 1–3 days, 1–2 weeks, >2 weeks, Not possible today

Which assumptions are we betting on — and which could break the plan?

• List the key assumptions driving your remediation plan (e.g., connector availability, business cooperation, directory consolidation timelines).
• Which of these assumptions would cause the whole timeline to fail if proven false? Options: Connectors ready on schedule, Business accepts JIT elevation, No role explosion during migration, Audit will accept automated evidence, IT Ops will allow phased cutovers
• Which assumptions have caused issues in prior IAM or PAM projects here?
• What governance or cultural changes will be hardest to sustain after deployment (e.g., certification cadence, owner accountability)?
• Who will own ongoing certification cadence and remediation after the project closes? Options: IAM team, Business owners, Internal Audit, Managed service partner, Not yet decided

Imagine the audit is closed — what will that feel like?

• What must be demonstrably true for auditors to close the finding and sign off?
• Which artifacts do you foresee auditors demanding as definitive proof? Options: Session recordings tied to incidents, Recertification logs, Evidence of orphaned account removal, Connector change logs, Secrets rotation history, Other
• How will you measure remediation progress at 30, 60, and 90 days (what specific metrics)?
• Which KPIs will the board or regulator expect to see at closure? Options: % orphaned accounts removed, Time to revoke privileged access, Number of privileged accounts under vault, Number of successful certification cycles, Reduction in shared accounts
• Who signs the final remediation attestation — and is that person already briefed and available? Options: CISO, Head of Internal Audit, Board Risk Committee, External Auditor, Other

What's the most dangerous edge-case we must solve?

• Which specific processes cannot tolerate brief credential removal or rotation (describe systems and business impact)?
• Do you operate SWIFT or payment flows that require operator IDs to remain continuously available? Options: Yes — continuous availability required, Yes — short tolerances, No, Not sure
• Are there homegrown or bespoke systems where a standard connector is impossible and manual controls must remain? Options: Yes — several, A few, No — all standard systems, Not yet assessed
• Which shared service accounts span multiple business units and would cause cross‑team outages if changed? Options: Database service accounts, Middleware/service bus accounts, Batch processing accounts, Trading settlement service accounts, Other
• How would you validate session termination tied to anomalous trading behavior without affecting live trades?

How do we make saying 'yes' easy for your committee?

• What procurement milestones or approvals trigger the release of funds or a purchase order in your organization? Options: Proof‑of‑Value / Pilot sign‑off, Security review passed, Budget approval, Contract execution, Board approval
• What procurement or contracting risks are most likely to delay signing (e.g., legal, SLAs, liability, data residency)?
• Which operational owners must be named before deployment can begin (roles, not people)? Options: IAM administrator, Connector developer, IT Ops runbook owner, Business application owner, Audit liaison
• What governance cadence would make you comfortable during rollout (choose preferred options)? Options: Weekly steering committee, Daily standups during cutover, Biweekly working sessions, Ad‑hoc as issues arise
• Which post‑deployment supports would reduce your risk perception most (select all that apply)? Options: 24/7 support during cutover, Runbook and playbook handover, Hands‑on training for Ops and Audit, Managed services option, Extended warranty

Small next steps we can commit to now

• What one small, non‑disruptive deliverable could we complete in the next 7–14 days to build momentum and confidence?
• Who specifically needs to approve that small deliverable (role or name)? Options: CISO, IAM lead, IT Ops lead, Internal Audit, Procurement
• What minimal data or access do we need from you to get started (select all that apply)? Options: Privileged account inventory export, Sample session logs, Test environment access, List of blackout windows, Contact list of stakeholders
• When can we schedule a focused 60–90 minute discovery workshop with the key stakeholders you named? Options: Within 3 business days, Within 1 week, Within 2 weeks, Later than 2 weeks
• Are there immediate legal, confidentiality, or procurement constraints we should know about before any data exchange?

• Experience Readiness Alignment
• Controlled JIT Elevation & Session Recording Run
• Secrets Rotation & Credential Vaulting Exercise
• Cross-Platform Lateral Movement Simulation
• Examiner-Ready Evidence Review & Acceptance

• Show that combined controls stop the attacker at defined checkpoints across platforms.
• Seller to provide connector checklist, runbook template, and list of required test accounts with steps for emergency rollback.
• Objective Reconfirmation & Scenario Recap
• Demonstrate that JIT elevation issues ephemeral privileges only for the approved window.
• Produce intact session recordings and logs that map to the auditor's evidence standard.
• Prove that anomalous activity triggers termination/containment stopping lateral movement.
• Collect tuning points and any gaps discovered for remediation planning.
• Seller to deliver the session recording files, integrity hashes, and parsed logs for the executed scenario.
• Customer to review recordings with internal audit to confirm artifact sufficiency and report back.
• Team to update JIT policy thresholds and connector timeouts per observed behavior.
• Objective & Scenario Selection
• Confirm that automated rotation successfully replaces credentials without service disruption.
• Verify that old secrets are immediately invalidated and cannot be used to pivot.
• Produce a complete rotation audit trail that meets the predetermined acceptance criteria.
• Validate rollback and emergency access procedures to remove operational risk.
• Seller to provide rotation logs, signed event trail, and a mapping of rotated secrets to services.
• Customer to run internal application smoke tests for the rotated services and report any anomalies.
• Update runbook with observed connector behavior and recommended timeout/retry settings.
• Scenario Recap & Attack Objectives
• Introductions & Objectives
• Produce a correlated timeline of events and artifacts demonstrating containment decisions.
• Identify tuning recommendations to reduce false positives and improve blocking speed.
• Seller to produce a correlated forensic timeline and correlation rules used during the simulation.
• Customer SOC to validate alerts against their incident playbook and provide feedback.
• Team to implement recommended tuning and schedule a re-run for any unresolved gaps.
• Compiled Evidence Presentation
• Customer and internal audit confirm whether the provided artifacts meet examiner requirements.
• Agree on a remediation and delivery plan for any gaps with owners and deadlines.
• Establish artifact handover, retention, and secure access procedures for audit review.
• Seller to deliver the finalized evidence package (signed session files, parsed logs, rotation trails) in the agreed secure format.
• Customer audit to provide formal acceptance or a gap list within the agreed SLA.
• Project team to schedule a final verification run and update the shared remediation backlog.
• Articulate a single-sentence current state and single-sentence future state agreed by all stakeholders.
• Enumerate and prioritize 2–4 real customer scenarios to run during the experience.
• Define explicit acceptance criteria and the auditor artifacts required for success.
• Confirm pre-work items, access requirements, safe windows, and responsible owners with deadlines.
• Customer to deliver one-sentence current-state statement, list of systems, relevant audit findings, and sample auditor evidence standard.
• Customer IT/Ops to grant scoped test access, enable requested log sinks, and confirm safe windows for live exercises.
• Current State (one-sentence)
• Configure Rotation Policy & Vaulting
• Attack Path Diagnosis
• Narrative Mapping to Audit Criteria
• Attack Path Mapping & Expected Controls
• Policy & Connector Configuration
• Stepwise Execution: Initial Compromise to First Pivot
• Consequence Quantification
• Non-Prod Rotation Run
• Gap Analysis vs Internal Audit Standard
• Future State Definition (one-sentence)
• Artifact Delivery & Retention Agreement
• Controlled Prod Rotation (Safe Window)
• Stepwise Execution: Mid-attack Pivot Attempts
• Live Execution: Request & Grant JIT Elevation
• Use Case & Scenario Selection
• Attempt Use of Revoked/Old Secrets
• Acceptance & Next Steps Toward Remediation Deadline
• Live Execution: Perform Privileged Actions & Attempt Pivot
• Detection, Correlation & Response Validation
• Acceptance Criteria & Evidence Standard
• Review Rotation Audit Trail & Evidence

• Deploy Centralized Privileged Credential Vault
• Onboard Mainframe RACF Profiles into Vault
• Integrate SWIFT Operator ID Management with CSP Evidence
• Migrate Privileged Accounts into Vault (AD, LDAP, Unix)
• Implement Role‑Based Access Controls and Role Catalog
• Configure Just‑In‑Time Privilege Elevation
• Enable Multi‑Factor Authentication for Privileged Access
• Automate Service Account Secrets Rotation
• Implement Session Recording and Secure Archival
• Configure Real‑Time Session Termination on Trading Anomalies
• Deploy Application Connectors for Core Banking and SaaS
• Configure Access Certification Campaigns with Examiner Reports
• Deploy Emergency Break‑Glass Access and Escalation Controls

Deploy Centralized Privileged Credential Vault

• Is a centralized credential vault currently in use or is this a net-new deployment? Options: Net-new deployment, Replacing existing vault, Extending existing vault
• Which environments must the vault cover (select all that apply)? Options: z/OS (mainframe), Windows AD, Linux/Unix, On-prem applications, AWS, Azure, GCP, SaaS
• What availability and RTO/RPO requirements must the vault meet? Options: Tier 1 - 24/7 highly available (RTO <1 hour), Tier 2 - Business hours with SLA (RTO <4 hours), Tier 3 - Non-critical (RTO <24 hours)
• Are there existing HSMs, KMS, or hardware keys the vault must integrate with? Options: Yes, No, Planned
• List any compliance or data residency constraints affecting vault location or architecture.
• What user groups will require admin/owner access to the vault? Options: Security/Infosec, IAM Team, Platform/Ops, Application Owners, Auditors
• Do you require automated onboarding workflows and API access for the vault? Options: Yes - automated APIs required, Yes - limited automation, No - manual onboarding acceptable

Onboard Mainframe RACF Profiles into Vault

• Do you operate IBM z/OS with RACF in scope for privileged access controls? Options: Yes, No, Planned
• How many RACF user IDs/profiles are estimated for onboarding? Options: <100, 100-1,000, 1,000-5,000, 5,000+
• Are RACF profiles managed centrally or split across multiple regions/business units? Options: Centralized, Distributed across units, Hybrid
• Which RACF access patterns must be preserved (e.g., batch jobs, operator consoles, CICSPlex usage)?
• Do you require session recording and keystroke capture for mainframe console access? Options: Yes, No, Partial
• Are there maintenance windows or trading windows when mainframe changes cannot occur? Options: Yes - strict windows, Yes - flexible windows, No
• What acceptance criteria will auditors require for RACF onboarding (e.g., proof of rotation, access logs)?

Integrate SWIFT Operator ID Management with CSP Evidence

• Do you operate SWIFT environment(s) that require CSP evidence and operator ID controls? Options: Yes - production SWIFT, Yes - test SWIFT, No
• How many SWIFT operator IDs and related service accounts are in scope? Options: <50, 50-250, 250-1,000, 1,000+
• Which SWIFT components require integration (Alliance Access, Alliance Messaging, FIN, CSP reporting)? Options: Alliance Access, Alliance Messaging, SWIFT CSP reporting, Other
• What CSP evidence artifacts are required by your auditor (e.g., rotation logs, operator session recordings, approval trails)?
• Do you require automated attestation that SWIFT credentials are rotated and unused operator IDs are removed? Options: Yes - fully automated, Partially automated, No - manual
• Are there latency or performance constraints for SWIFT operations during connector calls (max acceptable delay)?

Migrate Privileged Accounts into Vault (AD, LDAP, Unix)

• Which account stores are in scope for migration? Options: Active Directory, LDAP directories, Unix/Linux accounts, Other
• Approximately how many privileged accounts will be migrated per store? Options: <500, 500-2,500, 2,500-10,000, 10,000+
• Do you require discovery and entitlement analytics (role-mining) as part of migration? Options: Yes - full role-mining, Yes - basic discovery only, No
• Are there existing naming conventions, service account policies, or account ownership metadata to preserve? Options: Yes, No, Partial
• What rollback or cutover safeguards are required to prevent user lockout during migration?
• Will migration require staged waves by business unit or a big-bang approach? Options: Phased by BU, Phased by environment, Big-bang
• What success criteria will determine a completed migration (e.g., all privileged accounts vaulted and rotated, zero orphaned accounts)?

Implement Role‑Based Access Controls and Role Catalog

• Do you maintain an existing role catalog or will one be created during implementation? Options: Existing catalog, Create new catalog, Hybrid
• What is the expected number of roles to define and manage? Options: <50, 50-200, 200-1,000, 1,000+
• Should roles be derived automatically from entitlement data (role-mining) or manually defined? Options: Auto-derived, Manual definition, Combination
• Which stakeholders must approve role definitions and changes (select all that apply)? Options: IAM lead, CISO, Application owners, Internal audit, Business unit owners
• Do you require preventive controls to avoid role explosion (e.g., attribute-based templates, approval gates)? Options: Yes - strict prevention, Yes - moderate controls, No
• Will the role catalog need to integrate with HR or CMDB systems for ownership and lifecycle? Options: Yes - HR, Yes - CMDB, Both, No
• What acceptance criteria will validate RBAC implementation (e.g., reduced distinct entitlement sets, auditor sign-off)?

Configure Just‑In‑Time Privilege Elevation

• Which use cases require JIT elevation (interactive admin access, sudo, service troubleshooting, SWIFT ops)? Options: Interactive admin, Sudo elevation, Service troubleshooting, SWIFT ops, Other
• What maximum elevation durations and default timeouts do you require? Options: Minutes (1-30), Hours (1-8), Business hours only
• Do you require approval workflows (manual approvals) or automated risk-based elevation? Options: Manual approval, Automated risk-based, Hybrid
• Should JIT requests be tied to MFA and contextual signals (location, device, time)? Options: Yes - require context + MFA, MFA only, No
• Are there integrations required to ticketing or ITSM systems for elevation justification and audit? Options: Yes - integrate with ITSM, No
• How will success be measured for JIT (e.g., reduction in standing privileged accounts, time-to-elevation metrics)?

Enable Multi‑Factor Authentication for Privileged Access

• Which MFA factors are acceptable for privileged access (select all that apply)? Options: Hardware tokens (FIDO/U2F), TOTP mobile app, SMS OTP, Push notifications, Smartcards/PIV
• Do certain privileged roles require stronger MFA (e.g., SWIFT operators, domain admins)? Options: Yes - tiered MFA, No - uniform MFA
• Will MFA be enforced for all privileged sessions or only during elevation and remote access? Options: All privileged sessions, Only during elevation, Only remote access, Custom
• Are there existing MFA providers you must integrate with (Okta, Azure AD MFA, RSA, Duo)? Options: Okta, Azure AD MFA, RSA SecurID, Duo, Other, None
• What exception or break-glass rules are allowable for MFA failures for critical operations? Options: Temporary bypass with approval, No bypass allowed, Emergency break-glass only
• What user experience constraints exist (e.g., traders cannot be interrupted during trading window)?

Automate Service Account Secrets Rotation

• How many service accounts and secrets are in scope for automated rotation? Options: <500, 500-2,500, 2,500-10,000, 10,000+
• What rotation cadence is required for service account secrets (daily, weekly, monthly, custom)? Options: Daily, Weekly, Monthly, Quarterly, Custom
• Are there secrets that cannot be rotated without application changes or maintenance windows? Options: Yes - many, Yes - some, No
• Which secret types must be supported (passwords, API keys, certificates, SSH keys)? Options: Passwords, API keys, Certificates, SSH keys, Other
• Do you require integration with CI/CD pipelines or orchestration tools to propagate rotated secrets? Options: Yes - CI/CD integration, No
• What rollback or emergency restore mechanisms are required if rotation breaks an application?

Implement Session Recording and Secure Archival

• Which session types must be recorded (RDP, SSH, mainframe console, application UIs)? Options: RDP, SSH, Mainframe console, Web application sessions, Other
• What retention period is required for recorded sessions to satisfy auditors? Options: 30 days, 90 days, 1 year, Custom
• Are there storage location or encryption requirements for archived recordings? Options: On-prem encrypted storage, Cloud encrypted storage, HSM-backed keys, Other
• Do you require examiner-ready indexing and searchability (by user, date, command, or transaction)? Options: Yes - full indexing, Partial indexing, No
• Are there privacy or legal constraints about recording certain users or roles? Options: Yes - constraints exist, No
• What access controls and audit trails are required for access to the recordings?

Configure Real‑Time Session Termination on Trading Anomalies

• Do you operate time-sensitive trading systems where anomalous sessions must be terminated immediately? Options: Yes - trading systems in scope, No
• Which anomaly signals should trigger termination (unusual commands, large transfer attempts, atypical hours, geolocation)? Options: Unusual commands, Large transfer attempts, Atypical hours, New geolocation, Other

• Non-Disclosure Agreement (NDA)
• Master Services Agreement (MSA)
• Statement of Work (SOW)
• Commercial Terms & Pricing Schedule
• Procurement Milestones & PO Triggers
• Payment Schedule & Invoicing
• Service Level Agreement (SLA) & Support
• Acceptance Criteria & Go‑Live Conditions
• Security & Compliance Addendum (DPA & Audit Evidence)
• Roles, Responsibilities & Governance Plan
• Change Control & Escalation Matrix
• Implementation & Cutover Runbook (SOW Appendix)
• Connector Acceptance & Handover Checklist
• Risk Allocation & Liability Schedule
• Training, Knowledge Transfer & Documentation
• Renewal, Extension & Termination Terms
• PO Release Checklist

• Remediation Metrics Review
• Orphaned Privileged Accounts Certification
• Auditor‑Ready Evidence Delivery & Validation
• Shared Backlog & Continuous Improvement Planning
• Executive Remediation Sign‑off & Closeout

• Establish a sustainable governance cadence that prevents drift and avoids governance fatigue.
• Audit Acceptance Criteria Recap
• Deliver an evidence package that meets internal audit's acceptance criteria.
• Complete live validation of representative evidence and capture auditor feedback or rejection items.
• Agree on evidence retention schedule, access controls, and tamper-evidence procedures.
• Transfer the evidence package to the agreed audit repository and capture timestamped acknowledgements.
• Remediate any evidence gaps identified during live validation and re-submit within agreed SLA.
• Configure and document evidence retention and access controls per audit requirements.
• Backlog Intake Review (Pre-populated)
• Agree on a prioritized, owned backlog that captures all post-remediation issues and enhancements.
• Assign SLAs and escalation procedures for critical items impacting payments or trading.
• Introductions & Objective
• Create the shared backlog in the agreed tool and populate with owners, priorities, and SLAs.
• Schedule the recurring backlog governance meeting and distribute invite to stakeholders.
• Publish the phased release plan with safe windows tied to trading/transfer schedules.
• One‑line Current State, Consequence, Future State
• Obtain executive sign-off that remediation meets the board-mandated objectives.
• Confirm procurement and commercial triggers for PO release and closeout.
• Agree on formal communication plan to the board and regulators and archive ownership for evidence.
• Circulate signed executive minutes and the official remediation closeout statement to internal stakeholders and procurement.
• Trigger procurement billing/milestone actions tied to sign-off and update contract records.
• Prepare the board/regulator communication package and schedule delivery as agreed.
• Validate that the remediation metrics are accurate and computed from agreed data sources.
• Identify and categorize all remaining non-compliant privileged accounts and root causes.
• Assign owners and timelines for closure of outstanding remediation items.
• Agree on compensating controls for any items that cannot be closed within the remediation window.
• Deliver a signed, final remediation metrics report with data sources and calculation logic to internal audit.
• Create and assign tickets for each outstanding account or connector gap with target dates.
• Implement agreed compensating controls and verify operationalization.
• Recap of Certification Criteria (Pre-work)
• Confirm the removal of orphaned privileged accounts meets internal audit's certification criteria.
• Document any exceptions with clear remediation timelines and compensating controls.
• Produce a formal certification record signed by audit and CISO stakeholders.
• Publish the certification package (manifest of removed accounts, timestamps, and verification logs) to the audit repository.
• Open and assign remediation tickets for exceptions with SLA and escalation path.
• Update the privileged account inventory to reflect certified removals.
• Current State Snapshot (Pre-work)
• Remediation Outcomes vs 90‑day Mandate
• Prioritization & Scoring
• Evidence Package Walkthrough
• Discovery Methodology & Scope
• Live Validation of Sample Artifacts
• Ownership, SLAs & Escalation Paths
• Residual Risk & Compensating Controls
• Evidence Review — Sample Cases
• Metric Validation Methodology
• Commercial & Procurement Triggers
• Gap Analysis & Root Causes
• Chain-of-Custody & Retention Controls
• Exception Handling & Reconciliation
• Release / Rollout Schedule & Safe Windows
• Certification Vote & Sign-off Record
• Residual Risk Assessment
• Governance Cadence & Feedback Loop
• Handover & Acknowledgement
• Formal Sign-off, Communication, and Board Reporting
• Owners, Timelines & Next Steps