Yes, when the environment contains systems that will remain in service for a long time. PAM, vendor access governance and least privilege can reduce immediate exposure even when modernisation is slow, because they narrow the number of paths an attacker can use against fragile assets.
Why PAM Belongs Before Long Modernization Timelines
critical infrastructure rarely modernises as a single event. Plants, control networks, remote support paths and inherited administrative processes often stay active for years, so the question is not whether to modernise eventually, but what control reduces exposure now. PAM is valuable because it targets the access paths that usually matter most during the long transition period: privileged users, vendors and break-glass accounts.
When an environment has fragile or hard-to-replace assets, standing privilege is a faster risk to reduce than platform replacement. Modernisation may improve architecture later, but PAM can narrow blast radius immediately by forcing approval, session control, credential vaulting and time-bounded elevation around the highest-value accounts.
What Changes in a Critical Infrastructure Context
The argument for prioritising PAM strengthens when operational continuity depends on legacy systems, remote maintenance, or third-party engineering access. In those conditions, the main issue is not just who can log in, but how much authority that login can exercise. Controls like least privilege and just-in-time access and zero standing privilege reduce the window in which a compromised credential can be used.
PAM also helps where modernisation has to coexist with old platforms. Teams can segment privileged routes, constrain vendor access, and wrap better governance around systems that cannot yet be re-architected. That makes PAM a practical bridge control, not a substitute for modernisation, but a way to make delay less dangerous.
For vendor and remote support use cases, session oversight matters as much as account protection. Privileged session management gives teams evidence of what was done during a high-risk session, which is especially important when the operator is external, the asset is legacy, or the change window is narrow.
How to Decide Whether PAM Comes First
The practical decision is to prioritise PAM first when the following are true: the asset will stay in service for a long time, the access path is privileged or vendor-managed, the system is difficult to monitor directly, or compromise would have safety, availability or recovery consequences. In those cases, access control is the fastest meaningful reduction in exposure.
Teams should also treat emergency access as part of the same priority set. Break-glass accounts are unavoidable in many critical environments, but they must be designed and tested rather than left as opaque exceptions. Break-glass and emergency access accounts should be isolated from ordinary admin practice, because they become the fallback path when everything else fails.
- If the system will remain in production for years, reduce privileged exposure before waiting for replacement.
- If vendors need remote access, govern the session and the credential together.
- If the asset is safety- or availability-critical, treat excessive privilege as an active operational risk, not a future clean-up item.
Risk and Threat Considerations
Critical infrastructure is attractive to attackers because privileged access can convert one stolen credential into broad operational impact. Long-lived admin accounts, vendor pathways and shared emergency access increase the chance that an initial compromise becomes persistence, lateral movement or destructive action before modernisation delivers any benefit.
Failure mechanism: Excess standing privilege, weak vendor governance, or unmanaged break-glass access leaves a durable path into legacy systems even when the rest of the environment is being upgraded.
Impact: A compromised privileged path can disrupt operations, expose sensitive systems, or create recovery problems that are far more costly than the effort of putting PAM in place early.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | PAM for long-lived privileged access depends on lifecycle control of credentials and tokens. |
| AC-6 — Least Privilege | The question centers on reducing privileged exposure before modernization completes. | |
| IA-9 — Service Identification and Authentication | Critical infrastructure often relies on machine, vendor and service access paths that PAM must govern. | |
| Recommendation — Rotate, vault and expire privileged authenticators on a defined schedule. Restrict privileged accounts to the minimum access needed for the task. Require strong authentication for non-human and service-to-service access paths. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | PAM is a prescriptive access-control safeguard for risky privileged paths. |
| CIS-5 — Account Management | Legacy plants and vendor routes often depend on accounts that need tight lifecycle governance. | |
| Recommendation — Enforce centralized control over privileged access and remove unnecessary standing privilege. Inventory, disable and review privileged accounts before they become persistent exposure. | ||
| NIST CSF 2.0 | PR.AA-05 — Identity Management, Authentication and Access Control | The answer is about governing who can reach fragile systems and under what conditions. |
| PR.AA-02 — Identity Management | Prioritising PAM requires knowing which privileged identities and vendor accounts exist. | |
| PR.IR-01 — Network Resilience | PAM is a resilience measure when modernization is slow and legacy systems remain exposed. | |
| Recommendation — Apply access control that limits privileged paths and verifies authorized use. Maintain a current inventory of privileged identities and their access relationships. Reduce exposure on hard-to-replace systems so recovery and continuity are less fragile. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | PAM is a direct access-control response for legacy critical infrastructure exposure. |
| A.8.2 — Privileged access rights | The topic specifically concerns whether privileged access should be governed before modernization. | |
| Recommendation — Define and enforce access rules for privileged and vendor pathways. Review, restrict and time-limit privileged access rights on in-service systems. | ||
Practitioner Guidance
What to prioritise: Start with the privileged paths that can reach the most fragile or most consequential systems, especially vendor support routes, shared admin access and emergency accounts. That is where PAM changes risk fastest.
What to verify: Confirm that privileged sessions are attributable, time-bound and reviewable, and that standing access has been removed wherever the business can tolerate just-in-time elevation. If you cannot prove that, the control is not yet real.
Common mistake: Treating modernisation as the only meaningful remediation while leaving old admin paths untouched. In practice, the exposure often sits in the access layer long before the platform itself is replaced.
Practitioner takeaway: In critical infrastructure, PAM is often the first control that materially shrinks attack paths on systems you cannot retire quickly, so it should usually move ahead of replacement work when the asset remains exposed.
Related resources from NHI Mgmt Group
- How should security teams prioritise NHI remediation in cloud environments?
- How should incident response teams prepare for cyberattacks against critical infrastructure before a real crisis hits?
- What should critical infrastructure teams prioritise after OT protocol exploit activity is detected?
- How should government security teams manage privileged access and secrets before and after major infrastructure events?