PAM

What is PAM (Privileged Access Management)?

PAM (Privileged Access Management) is the combination of policy, processes and technology an organisation uses to manage accounts with elevated privileges, restrict access through them and record and control every use of them. These are accounts that can change system or network configurations, install software or manipulate industrial processes: domain administrators, local admin accounts, service accounts and the engineering accounts of suppliers. PAM is a specialised part of access management and security in general. In OT environments it mainly protects SCADA, PLCs and engineering stations against misuse and sabotage, because a single privileged account there has a direct effect on a physical process.

🧠 Why is PAM important?

Attackers almost always go after administrative rights: whoever controls a privileged account can disable security controls, wipe logs and move through the network unseen. OT adds its own weak spots that have grown over many years.

The Colonial Pipeline attack in 2021 showed how this plays out: attackers logged in through a VPN account that was no longer in use, with a leaked password and without MFA. PAM and sound identity management target exactly this kind of account. That makes PAM a core building block of Zero Trust and Defense in Depth, and the technical enforcement of Least Privilege.

🔐 What does a PAM solution do?

A mature PAM solution combines several functions that together cover the life cycle of a privileged account:

Together these functions mean an administrator no longer knows a password but is granted access each time, for one task, with a trail that can be checked afterwards.

🏭 What does PAM look like in an OT environment?

In most industrial architectures the PAM solution, or its access portal, sits in the IDMZ between the office network and the process network. All administration goes through that single controlled route, usually combined with a jump server.

OT does require some adjustments compared with an IT roll-out:

• Not everything can be rotated - older HMIs, PLCs and service accounts of SCADA software sometimes have hard-coded passwords, and automatic rotation can stop a process. Test in a test environment first, and exclude such accounts or rotate them manually during a shutdown.
• Many devices have no users - a PLC often has only a project password. PAM then protects the route (the engineering station), not the device itself.
• Availability comes first - if the PAM solution fails, the on-call team must still be able to intervene. Define an emergency procedure, such as the Red Envelope Procedure with sealed emergency credentials.
• PAM is a target itself - whoever owns the vault owns everything. In December 2024 attackers abused a stolen API key of the BeyondTrust Remote Support SaaS service to reach, among others, workstations at the US Department of the Treasury. Treat the PAM platform as a crown jewel: hardened configuration, timely patching and continuous monitoring.

📏 Which standards and laws call for PAM?

PAM is rarely prescribed by name, but the requirements behind it appear in almost every framework:

The Dutch Cybersecurity Act (Cyberbeveiligingswet) and Cybersecurity Decree have applied since 15 August 2026. For essential and important entities, demonstrable control of privileged access is therefore part of the duty of care, including for OT.

🧭 How do you implement PAM step by step?

1. Inventory privileged accounts - domain administrators, local admins on HMIs and servers, service accounts, shared accounts and supplier accounts. In OT this almost always brings surprises.
2. Classify by risk - start with the accounts that can do the most: domain administration, engineering stations, Safety PLCs and external access.
3. Set up one access route - a PAM portal or jump server in the IDMZ, with MFA/2FA for strong authentication and a separate identity domain for OT.
4. Bring suppliers on board - personal accounts instead of shared ones, access per job and mandatory session recording; lay this down in contracts through supplier security.
5. Enable rotation in phases - first IT-like systems (Windows servers, Active Directory), then OT components after testing.
6. Connect logging to detection - send session and audit logs to the SIEM or OT SOC and periodically review who holds which rights.
7. Rehearse the emergency procedure - test break-glass access at least once a year so it works when the PAM system is unreachable.

Common practical choices are a session length of a few hours for maintenance, rotation immediately after every use for the most critical accounts and a six-monthly review of rights. These are design choices, not values from a standard; record them in your access policy.

🔧 Which PAM solutions are well known?

In addition, several OT security vendors offer secure remote access platforms that combine PAM functions such as approval, vaulting and session recording with OT-specific protocols.

❓ Frequently asked questions

What is the difference between PAM and IAM?

IAM (Identity and Access Management) handles the identity and basic access of every user in an organisation. PAM is a specialised part of it that focuses on the small group of accounts with elevated rights, adding measures such as a password vault, session recording and just-in-time access. The two work together: IAM establishes who someone is, PAM controls how that person uses administrative rights.

Is PAM mandatory under NIS2 or the Dutch Cybersecurity Act?

NIS2 and the Dutch Cybersecurity Act do not mention PAM by name, but they do require access control policies and, where appropriate, multi-factor authentication. The Cybersecurity Decree elaborates that access policy in Article 15. For privileged accounts in OT, PAM is a common practical way to demonstrate that you comply.

Can PAM protect PLCs that have no user management?

Yes, but indirectly. Many PLCs only have a project password, so PAM protects the route to them: the engineering station or jump server running the programming software. Combined with network segmentation, this ensures that a PLC can only be reached through that controlled, recorded session.

What is just-in-time access?

Just-in-time access means a user receives administrative rights only for a defined period and a specific task, after which those rights expire automatically. There are then no standing administrative rights for an attacker to steal. In OT, just-in-time access is often tied to an approved maintenance job.

What happens if the PAM system fails?

If the PAM system fails, an organisation must still be able to intervene in the process. That is why organisations define a break-glass or Red Envelope procedure with sealed emergency credentials that are replaced immediately after use. A highly available set-up of the PAM platform reduces the chance that this procedure is needed.

How does PAM handle supplier access?

PAM gives each supplier engineer a personal account, access only to the systems in scope of the job and only during an approved time window. The engineer never sees passwords, the session is recorded and access expires afterwards. In this way PAM replaces the permanent VPN connections and shared accounts that suppliers used in the past.

📌 In summary

PAM (Privileged Access Management) ensures that administrative rights in IT and OT no longer exist permanently and anonymously, but are granted per task, temporarily, with approval and fully recorded. With a password vault, session recording, just-in-time access and one controlled route through the IDMZ, PAM protects SCADA, PLCs and engineering stations in critical infrastructure, and helps you demonstrate compliance with IEC 62443, NIS2 and the Dutch Cybersecurity Act.