Notifications
Clear all
Topic starter
09/07/2026 1:41 pm
TL;DR: FedRAMP High authorization for Secret Server puts privileged access governance, just-in-time controls, and auditability in scope for federal agencies modernizing access across human, machine, and AI identities, according to Delinea. The real signal is that regulated environments now expect defensible runtime access decisions, not just vaults and approvals.
NHIMG editorial — what this means for NHI practitioners
By the numbers:
- 99.995% uptime is the availability level Delinea says its platform delivers.
- 90% fewer resources are required, quired, according to Delinea.
Questions worth separating out
Q: How should federal teams reduce standing privilege without slowing operations?
A: Start by identifying which elevated rights are actually task-bound and which are permanently assigned by habit.
Q: Why does FedRAMP High matter for privileged access management?
A: FedRAMP High matters because it requires stronger proof that access controls are governed, auditable, and suitable for sensitive unclassified data.
Q: What breaks when privileged access is not monitored at session level?
A: Approval alone does not show whether the access was used appropriately, misused, or expanded into other systems.
Practitioner guidance
- Map federal privileged accounts to task-scoped access paths Identify where standing privilege still exists for administrators, service accounts, and break-glass workflows, then convert those paths to just-in-time elevation with explicit expiry and approval evidence.
- Require session records for every elevated access event Make session monitoring part of the control objective so investigators and auditors can reconstruct what happened after approval, not just who clicked approve.
- Review non-human privileged identities alongside human admin roles Include service accounts, automation credentials, and AI-enabled operational identities in the same PAM governance cycle so elevated access is not exempted by actor type.
What's in the full announcement
Delinea's full article covers the operational detail this post intentionally leaves for the source:
- How Secret Server is positioned for FedRAMP High use in federal environments
- The specific privileged access capabilities that support just-in-time authorisation and session recording
- How Delinea and UberEther frame the federal deployment and compliance path
- Where the source article describes federation, approval workflows, and encrypted vaulting in more operational detail
👉 Read Delinea's FedRAMP High announcement for Secret Server →
FedRAMP High for PAM: what changes for federal identity teams?
Explore further
09/07/2026 1:45 pm
FedRAMP High is now an access governance benchmark, not just a cloud compliance label. In regulated federal environments, the practical test for PAM is whether it can produce defensible access decisions under independent review. That pushes identity teams to treat runtime authorization, approval evidence, and session records as core assurance artefacts. Practitioners should read this as a shift from control presence to control proof.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to The State of Secrets in AppSec.
A question worth separating out:
Q: Who should own privileged access governance across human and non-human identities?
A: Identity governance and PAM teams should share ownership, because privileged access now spans administrators, service accounts, and automated operational identities. If those actors are managed separately, the organisation usually ends up with inconsistent policy, weak accountability, and blind spots in audit evidence.
👉 Read our full editorial: FedRAMP High brings PAM into the AI-era access control baseline
