Check-In/Check-Out, or CICO, is a workforce access model where users receive a controlled set of permissions for a limited period and then return them when the task ends. It is used for sensitive systems to reduce standing access, often alongside PAM, approvals and session logging.
How CICO Reduces Standing Access
Check-In/Check-Out is a time-boxed access pattern, not a permanent role model. It gives a user the permissions needed for a specific task, then removes or expires them when the task is complete, which narrows the window for misuse and accidental overreach.
The practical value of CICO is that it turns elevated access into an exception with a clear start and end point. That makes it easier to separate ordinary day-to-day activity from sensitive work that should only happen under controlled approval.
Where CICO Fits in Privileged Access Management
CICO is often implemented through airport cybersecurity controls in environments where temporary access must be coordinated with operational continuity, supplier access, and degraded-mode procedures. More generally, it sits alongside PAM because both are trying to reduce standing privilege and make privileged use more deliberate.
In mature access programmes, CICO is one of the ways organisations convert a broad entitlement model into task-based authority. It is especially useful where technicians, analysts, contractors, or responders need occasional high-trust access but do not need it every day.
Operational Controls Behind a Check-In/Check-Out Workflow
A workable CICO process depends on more than a form or ticket. The organisation needs a reliable approval path, a source of truth for who currently holds access, and a mechanism to return permissions automatically or through enforced review when the task ends.
Session logging is an important companion control because it preserves accountability for what was done while the temporary access was active. Without clear logging and revocation, a check-out process can become a paper exercise that leaves the same exposure in place.
CICO is also sensitive to scope creep. If the checked-out access is broader than the task requires, or if the checkout window is routinely extended without justification, the model starts to resemble permanent access in disguise.
Why CICO Matters for High-Trust Systems
CICO is useful wherever access to a system has disproportionate operational or security impact. In those environments, the main question is not whether access is needed at all, but whether it should exist only for the brief period in which it is genuinely required.
The model reduces the time available for credential misuse, unauthorized changes, and unreviewed activity after a task is complete. It also creates a cleaner governance boundary, because ownership of the access decision is explicit instead of being hidden inside a standing entitlement.
Risk and Threat Considerations
Check-In/Check-Out lowers exposure, but it can fail if revocation is delayed, approvals are too loose, or access is reissued so often that the temporary workflow becomes effectively permanent. The biggest risk is that an organisation believes it has removed standing privilege when in practice it has only added extra steps around the same access.
Failure mechanism: Attackers or insiders can abuse the active checkout window, extend access through weak governance, or retain effective privilege if checkout does not fully revoke the underlying permissions.
Impact: Unauthorized changes, data exposure, persistence, and harder post-incident review can follow, especially when temporary access is used for sensitive administrative tasks.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 provides the primary governance reference for this term.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | CICO governs temporary account activation and revocation for privileged tasks. |
| IA-5 — Authenticator Management | CICO depends on controlling the credentials used during the checkout period. | |
| AU-2 — Event Logging | CICO is strongest when checkout sessions are auditable and attributable. | |
| Recommendation — Use AC-2 to enforce timely activation, suspension, and removal of temporary access. Use IA-5 to manage issued credentials and revoke or rotate them after use. Use AU-2 to log privileged checkout activity and preserve accountability for task-based access. | ||
Practitioner Guidance
Why practitioners should care: CICO only works when the access grant is truly temporary and the return path is enforced. If the organisation cannot prove who had access, for how long, and when it was removed, the control is weak even if the process looks formal.
What to watch for: Repeated extensions, manual exceptions, or unclear ownership of checkout and revocation usually indicate that the workflow is drifting away from least privilege. That is the point to tighten approvals, automation, and review discipline.
Related resources from NHI Mgmt Group
- What should organisations check before rolling out zero standing privilege at scale?
- What should teams check before rolling out passwordless access at scale?
- What should IAM teams check before rolling MFA out to a sensitive application?
- What breaks when pull_request_target workflows check out and execute incoming pull request code?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 29, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org