Monitor
We track your privileged accounts and secrets at agreed intervals.
Deliverables- Privileged account inventory kept up to date
- Check of provider access and its expiry dates
- Alerts on keys and certificates to renew
Domain · Privileged access and secrets (PAM)
The accounts that open everything, under control.
We inventory your privileged accounts and secrets, separate administration from everyday use, frame every sensitive access and get passwords and keys out of code and spreadsheets.
Situations
You are in the right place if…
- Your administrators use the same account to read their email and to administer your servers.
- Shared “admin” accounts circulate between teams and providers, and nobody knows who did what.
- Passwords and API keys are written in clear in code, scripts or a spreadsheet.
- A managed service provider has permanent access to your critical systems.
- Nobody knows when your encryption keys and certificates were last renewed.
Our conviction
An attacker goes for your administration accounts: that is where protection pays most.
A serious intrusion most often goes through taking over privileged accounts and the directory. A secret left in code or a shared administration account shortens that path.
We therefore focus the effort on that access: accounts dedicated to administration, access granted when needed and traced, secrets kept in a vault and keys managed over their whole life cycle.
Our approach
From the privilege inventory to the vault.
A narrow but critical scope, handled first.
- 01InventoryAdministration accounts, service and technical accounts, provider access, secrets and keys: where they are, who holds them, what they open.
You getAn inventory of privileges and secrets
- 02SeparateDedicated administration accounts, separate administration workstations and paths, an end to shared accounts, strong authentication.
You getA target administration model
- 03FrameBastion, just-in-time and approved access, recording of sensitive sessions, time-bound provider access.
You getPrivileged access rules and their tooling
- 04Store the secretsVault, secrets removed from code and scripts, rotation, management of keys and certificates over their whole life cycle.
You getA secrets and key management policy
What the texts say
What the texts expect of privileged access and secrets.
The texts single out administration access and keys: granted when needed, strongly authenticated and protected over their whole life cycle.
- DORA · RTSDORA art. 9(4), point (d) · RTS 2024/1774 art. 21, point (e) (ii) · RTS 2024/1774 art. 21, point (f) (ii)
DORA asks financial entities for policies and protocols for strong authentication and protection measures for cryptographic keys; its RTS specifies that they grant privileged, emergency and administrator access only on a need-to-use or ad hoc basis, and require strong authentication for privileged access, remote access and assets supporting critical or important functions.123
- DORA · RTSRTS 2024/1774 art. 7(1) · RTS 2024/1774 art. 7(2) · RTS 2024/1774 art. 7(3)
Their cryptographic key management policy covers the keys’ whole life cycle, from generation to destruction, protects them against loss, unauthorised access, disclosure and modification, and provides for replacing them when lost or compromised.456
- ReCyFReCyF v2.5, objectif 11
ReCyF (working version) sets entities the objective of administration accounts dedicated exclusively to that use and reserved to authorised persons, including for whoever administers on their behalf, and essential entities that of securing the administration of their directories.7
- CNIL guideGuide CNIL sécurité, fiche 9, F09-PE-03 · Guide CNIL sécurité, fiche 21, F21-PE-04 · Guide CNIL sécurité, fiche 21, F21-PE-05 · Guide CNIL sécurité, fiche 22, F22-PE-07
The CNIL recommends a password policy specific to administrators, protecting secret keys with restrictive access rights, writing a procedure for managing keys and certificates and, in the cloud, managing keys appropriately and granting only the access needed.891011
The texts do not apply to every organisation: whether they apply depends on your status, your sector, your size and your contracts. Have it confirmed by your legal counsel or a specialised lawyer.
Our engagementLevel 01 Level 02 Level 03
The same topic, at three levels of engagement.
You choose the level; the scope and deliverables are set by contract.
Advise
We design the administration model and the secrets management policy, and recommend tooling, which you decide on.
Deliverables- Inventory of privileges and secrets
- Administration model and privileged access rules
- Secrets and key policy, selection criteria for a bastion and a vault
Drive
We run the programme with your IT, development teams and providers, without making the changes in your systems.
Deliverables- Management of the bastion and vault roll-out
- Follow-up of shared accounts and clear-text secrets removed
- Evidence ready for the auditor or the authority
AcceleratorsAdministration model Finding clear-text secrets Your tracking web app
What we bring from day one.
Dedicated accounts, administration tiers and access paths: a target model to adapt to your systems.
A method and rules to find the passwords and keys left in your code repositories and scripts.
Privileged accounts, secrets, keys and gaps in a tool shared with your teams.
Frequently asked questions
Before we start.
Is a bastion enough?
No. A bastion traces and filters access, but prevents neither shared accounts, nor secrets left in code, nor administration from an exposed workstation. It belongs in a complete administration model.
What about service and technical accounts?
Inventory them, give each an owner, cut their rights to what is strictly needed and keep their secrets in a vault with rotation. They are often the most powerful accounts and the least watched.
Should our providers go through the same set-up?
Yes. Dedicated administration accounts also apply to whoever administers on your behalf; their access is moreover time-bound and traced.7
Do you work on our servers?
No. We design, run and verify; your teams or your integrator deploy the bastion, the vault and the changes. We can help you find the right integrator, whom you mandate.
Start with your twenty most powerful accounts.
Describe your administration accounts, your provider access and where your secrets live. We come back to you with a scoping proposal.
Sources
The excerpts quoted.
Exact text, in its original language, from the frameworks extracted from the official text.
Show the 11 excerpts quoted
- 1DORA art. 9(4), point (d)
32022R2554-a9-p4-4implement policies and protocols for strong authentication mechanisms, based on relevant standards and dedicated control systems, and protection measures of cryptographic keys whereby data is encrypted based on results of approved data classification and ICT risk assessment processes;
- Normative force
- directly applicable EU law (regulation, level 1)
- Source
- Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector
- Version
- CELEX 32022R2554 — ELI reg/2022/2554
- 2RTS 2024/1774 art. 21, point (e) (ii)
32024R1774-a21-p0-7assignment of privileged, emergency, and administrator access on a need-to-use or an ad-hoc basis for all ICT systems;
- Normative force
- directly applicable EU law (delegated regulation — RTS, level 2)
- Source
- Commission Delegated Regulation (EU) 2024/1774 of 13 March 2024 supplementing Regulation (EU) 2022/2554 with regard to regulatory technical standards specifying ICT risk management tools, methods, processes, and policies and the simplified ICT risk management framework
- Version
- CELEX 32024R1774 — ELI reg_del/2024/1774
- 3RTS 2024/1774 art. 21, point (f) (ii)
32024R1774-a21-p0-12the use of strong authentication methods in accordance with leading practices and techniques for remote access to the financial entity’s network, for privileged access, for access to ICT assets supporting critical or important functions or ICT assets that are publicly accessible;
- Normative force
- directly applicable EU law (delegated regulation — RTS, level 2)
- Source
- Commission Delegated Regulation (EU) 2024/1774 of 13 March 2024 supplementing Regulation (EU) 2022/2554 with regard to regulatory technical standards specifying ICT risk management tools, methods, processes, and policies and the simplified ICT risk management framework
- Version
- CELEX 32024R1774 — ELI reg_del/2024/1774
- 4RTS 2024/1774 art. 7(1)
32024R1774-a7-p1Financial entities shall include in the cryptographic key management policy referred to in Article 6(2), point (d), requirements for managing cryptographic keys through their whole lifecycle, including generating, renewing, storing, backing up, archiving, retrieving, transmitting, retiring, revoking, and destroying those cryptographic keys.
- Normative force
- directly applicable EU law (delegated regulation — RTS, level 2)
- Source
- Commission Delegated Regulation (EU) 2024/1774 of 13 March 2024 supplementing Regulation (EU) 2022/2554 with regard to regulatory technical standards specifying ICT risk management tools, methods, processes, and policies and the simplified ICT risk management framework
- Version
- CELEX 32024R1774 — ELI reg_del/2024/1774
- 5RTS 2024/1774 art. 7(2)
32024R1774-a7-p2Financial entities shall identify and implement controls to protect cryptographic keys through their whole lifecycle against loss, unauthorised access, disclosure, and modification. Financial entities shall design those controls on the basis of the results of the approved data classification and the ICT risk assessment.
- Normative force
- directly applicable EU law (delegated regulation — RTS, level 2)
- Source
- Commission Delegated Regulation (EU) 2024/1774 of 13 March 2024 supplementing Regulation (EU) 2022/2554 with regard to regulatory technical standards specifying ICT risk management tools, methods, processes, and policies and the simplified ICT risk management framework
- Version
- CELEX 32024R1774 — ELI reg_del/2024/1774
- 6RTS 2024/1774 art. 7(3)
32024R1774-a7-p3Financial entities shall develop and implement methods to replace the cryptographic keys in the case of loss, or where those keys are compromised or damaged.
- Normative force
- directly applicable EU law (delegated regulation — RTS, level 2)
- Source
- Commission Delegated Regulation (EU) 2024/1774 of 13 March 2024 supplementing Regulation (EU) 2022/2554 with regard to regulatory technical standards specifying ICT risk management tools, methods, processes, and policies and the simplified ICT risk management framework
- Version
- CELEX 32024R1774 — ELI reg_del/2024/1774
- 7ReCyF v2.5, objectif 11
recyf:obj-11Les entités [importantes ou essentielles], ou toute personne qu’elles ont mandatée pour réaliser les activités d’administration, disposent de comptes d’administration exclusivement dédiés à cet usage et utilisés par les seules personnes autorisées. Les entités [essentielles] s’assurent de la sécurisation de l’administration de leurs annuaires en s’appuyant sur les recommandations de l’autorité nationale de sécurité des systèmes d’information.
- Normative force
- obligation (decree, resilience bill)
- Source
- ReCyF — Référentiel Cyber France (NIS 2, transposition nationale)
- Version
- 2.5 du 17/03/2026 (version de travail)
- Status
- Working version: not binding until the transposition is enacted
- 8Guide CNIL sécurité, fiche 9, F09-PE-03
F09-PE-03Adopter une politique spécifique de mots de passe pour les administrateurs. Changer les mots de passe, au minimum, lors de chaque départ d’un administrateur et en cas de suspicion de compromission.
- Normative force
- recommendation (soft law)
- Source
- Guide pratique RGPD — Sécurité des données personnelles
- Version
- 2024 (mise à jour 2026)
- 9Guide CNIL sécurité, fiche 21, F21-PE-04
F21-PE-04Protéger les clés secrètes, au moins par la mise en œuvre de droits d’accès restrictifs et d’un mot de passe sûr.
- Normative force
- recommendation (soft law)
- Source
- Guide pratique RGPD — Sécurité des données personnelles
- Version
- 2024 (mise à jour 2026)
- 10Guide CNIL sécurité, fiche 21, F21-PE-05
F21-PE-05Rédiger une procédure indiquant la manière dont les clés et certificats vont être gérés en prenant en compte les cas d’oubli du mot de passe de déverrouillage.
- Normative force
- recommendation (soft law)
- Source
- Guide pratique RGPD — Sécurité des données personnelles
- Version
- 2024 (mise à jour 2026)
- 11Guide CNIL sécurité, fiche 22, F22-PE-07
F22-PE-07Appliquer les précautions élémentaires du présent guide aux traitements dans le cloud. En particulier : chiffrer les données au repos et en transit et avoir une gestion des clés cryptographiques appropriée (voir la fiche n°21 - Chiffrement, hachage, signature). Il est à noter que l’utilisation des services de gestion de clefs proposés par le fournisseur de service implique que ce dernier a la capacité d’accéder aux données ; attribuer méticuleusement les accès et autorisations aux seules personnes habilitées à accéder aux ressources (données et applications) dans le cloud et appliquer le principe de moindre privilège (voir la fiche n°5 - Gérer les habilitations) ; authentifier les utilisateurs pour les accès aux services dans le cloud (voir la fiche n°4 - Authentifier les utilisateurs) et n’accorder que les habilitations nécessaires (voir la fiche n°5 - Gérer les habilitations) ; configurer les permissions liées aux ressources dans le cloud ; réaliser des sauvegardes (voir la fiche n°17 - Sauvegarder) et vérifier que le fournisseur dispose bien de lieux de sauvegarde géographiquement éloignés des centres de données.
- Normative force
- recommendation (soft law)
- Source
- Guide pratique RGPD — Sécurité des données personnelles
- Version
- 2024 (mise à jour 2026)