You fully document your overarching security governance and risk management approach, technical security practice and specific regulatory compliance. Cyber security is integrated and embedded throughout policies, processes and procedures and key performance indicators are reported to your executive management.

Silverfort enforces flexible access policies, and organisations can embed cybersecurity into their policies, processes, and procedures. Admins can define access control policies based on specific user roles, risk scenarios and organisational security policies. Silverfort enforces these policies in real time, so only authorised users and devices can gain access to the resources they are assigned to.

Policies, processes, and procedures that rely on user behaviour are practical, appropriate and achievable.

With Silverfort, organisations can configure access policies based on user rules for both on-prem and cloud environments. These policies can enforce alerting, MFA, or block access upon insecure authentication to protected systems. PAS enables organizations to simplify security controls by eliminating the need for complex security measures like password rotation and vaulting, and instead applying strict access policies to all privileged users.

You review and update policies, processes and procedures at suitably regular intervals to ensure they remain relevant. This is in addition to reviews following a major cyber security incident.

Silverfort continuously analyses user behaviour, devices, locations, security events, and other risk factors to easily adjust any access policies when needed. This allows for the review and update of policies, processes, and procedures at regular intervals to ensure the applied access policies remain relevant.

Your process of initial identity verification is robust enough to provide a high level of confidence of a user’s identity profile before allowing an authorised user access to network and information systems that support your essential function(s).

Silverfort can enforce MFA on any access request, whether on-prem, remote, or third-party, and for every level, from regular users to admins. In an Active Directory (AD) environment, Silverfort can enforce MFA and block access policies on any LDAP/S, NTLM, and Kerberos authentications. This expands the scope of MFA protection to a wide array of resources and access methods that couldn't have been protected before, such as command-line tools, legacy applications, IT infrastructure and more. Silverfort ensures no access is granted based on passwords alone, and users are required to authenticate through MFA to verify that they are who they claim to be.

The number of authorised users and systems that have access to all your network and information systems supporting the essential function(s) is limited to the minimum necessary.

Silverfort detects user behaviour, devices, locations, and other risk factors to calculate the risk score of each user authentication request. This allows the organisation to configure and apply access policies to ensure only authorised users have access to resources in the environment. Silverfort PAS enables organizations to reduce the attack surface by decreasing the number of standing privileges through its Just-in-Time access capabilities.

You use additional authentication mechanisms, such as multi-factor (MFA), for all user access, including remote access, to all network and information systems that operate or support your essential function(s).

Silverfort can enforce MFA protection across all users and resources, both on-prem and in the cloud. This applies to all Active Directory authentications, including those that couldn't be protected by MFA before, such as legacy applications, command-line access, databases, networking infrastructure and many others. Silverfort can also enforce MFA protection on all remote access to on-prem and cloud systems and on any third-party application that is accessed on-prem or via a cloud directory.

The list of users and systems with access to network and information systems supporting and delivering the essential function(s) is reviewed on a regular basis, at least every six months. Your approach to authenticating users, devices and systems follows up to date best practice.

Silverfort provides an in-depth identity inventory that displays the types of users and resources in the environment as well as security weaknesses. This enables you to detect and respond to potential security threats, including blocking the access of any accounts that display anomalous behaviour. Silverfort provides full visibility into all user accounts' authentication trails, while alerting on any excessive access requests and detected malicious activity. This allows admins to perform scheduled, continuous, and as-needed security reviews.

Privileged user access to network and information systems supporting your essential function(s) is carried out from dedicated separate accounts that are closely monitored and managed.

Silverfort PAS offers automated discovery and classification of all privileged accounts based on actual authentication activity. This allows organizations to know exactly which accounts have privileged access and monitor their usage patterns in real-time. PAS enforces frictionless Just-in-Time (JIT) access policies that remove standing privileges by granting access rights only when necessary, significantly enhancing security posture.

The issuing of temporary, time-bound rights for privileged user access and/or external third-party support access is in place.

Silverfort PAS implements temporary, time-bound access through its Just-in-Time (JIT) privileged access management capabilities. The solution automatically provisions privileged access rights only when necessary and for the minimum duration required, eliminating standing privileges. For both internal privileged users and external third-party support personnel, Silverfort enforces session-based access controls with predefined expiration periods. Access rights are automatically revoked when the approved time window expires, ensuring no persistent privileged access remains. This approach significantly reduces the attack surface by minimizing the timeframe during which privileged credentials could potentially be compromised or misused.

Privileged user access rights are regularly reviewed and always updated as part of your joiners, movers, and leavers process.

Silverfort continuously monitors user activities and access rights across the network, including privileged users. This monitoring ensures that any changes in access rights or user roles are promptly detected. Silverfort PAS allows organizations to "fence" privileged accounts to their intended purpose, limiting the misuse of admin accounts outside their intended purpose and blocking lateral movement attempts.

The number of authorised users and systems that have access to all your network and information systems supporting the essential function(s) is limited to the minimum necessary.

Silverfort continuously monitors user activities and access rights across the network, including privileged users. This monitoring ensures that any changes in access rights or user roles are promptly detected. Silverfort access policies can dictate the appropriate level of access for different users based on their roles and responsibilities. With PAS, organizations can reduce the risk of overexposure and unnecessary access by enforcing strict privilege limitations and access boundaries.

You follow a robust procedure to verify each user and issue the minimum required access rights, and the application of the procedure is regularly audited.

Silverfort can enforce MFA protection across all users and resources, on-prem and in the cloud. This applies to all Active Directory authentications, including those that couldn't be protected by MFA before, such as legacy applications, command-line access, databases, networking infrastructure and many others. Silverfort ensures no access is granted based on passwords alone, and users are required to authenticate through MFA to verify that they are who they claim to be. PAS enables organizations to implement Zero Standing Privileges at scale by eliminating privileged standing permissions and implementing Just-in-Time access rights.

User access rights are reviewed both when people change roles via your joiners, leavers, and movers process and at regular intervals - at least annually.

Silverfort continuously monitors all user activities and access requests across the environment. This monitoring ensures that any changes in access rights or user roles are promptly detected. Silverfort access policies can dictate the appropriate level of access for different users based on their roles and responsibilities. The JML process allows these policies to be flexibly adjusted to reflect changes in user status within the organisation.

You regularly review access logs and correlate this data with other access records and expected activity.

Silverfort provides admins with a detailed log screen that documents every authentication and access attempt in the environment. The log screen includes optional filters to detect insecure authentications, suspicious activity, misconfigurations, and other anomalies. Silverfort detects and alerts against invalid access attempts that appear to be malicious.

Attempts by unauthorised users, devices, or systems to connect to the systems supporting the essential function(s) are alerted, promptly assessed and investigated.

Silverfort monitors all authentications and access requests across the organisation and alerts/denies anomalous activity, including attempts at lateral movement. Furthermore, Silverfort requires MFA on every "hop", or move from one asset to another, so that stolen credentials cannot be used to progress in the attack path.

Your monitoring data provides enough detail to reliably detect security incidents that could affect the operation of your essential function(s).

Thanks to its native integrations with all identity providers, Silverfort monitors all identity traffic and authentication activities in one place and provides centralised visibility into every authentication and access request across all users and resources in the hybrid environment. With complete visibility across all user activity, Silverfort's analysis engine can determine the risk of every authentication, so organisations can detect and respond to potential security threats in real time — including blocking the access of any accounts that display anomalous behaviour.

Extensive monitoring of user activity in relation to the operation of your essential function(s) enables you to detect policy violations and an agreed list of suspicious or undesirable behaviour.

Silverfort provides organisations with a detailed log screen that documents every authentication and access attempt carried out in the environment. When malicious access occurs, Silverfort detects and alerts console admins of security threats. Silverfort PAS detects actual access usage patterns and behavior to classify different user tiers and identify when regular accounts are being used with privileged intent.