Most privileged access reporting tells the board how many accounts were onboarded into a vault, which says nothing about whether one stolen administrator or service account credential could still take the organisation down. This guide sets out a small board-level set of key performance indicators (KPIs) and key risk indicators (KRIs) for privileged access management, each with a formula, a suggested threshold and the decision it supports. It covers human administrators and privileged non-human identities together, because attackers do not distinguish between them. It is written for CISOs, heads of identity and the risk and audit staff who prepare board packs. Platform and vault operating measures are deliberately left to the PAM Vault Health Check, and capability levels to the PAM Maturity Model; this page is about the few outcome numbers that show privileged risk going down.
Key takeaways
- Measure blast radius, not onboarding. The board question is how much damage one compromised privileged identity could do and how fast it would be stopped.
- Pair every KPI with a KRI. Rising just-in-time adoption alongside a rising count of paths to tier zero means the programme is moving but the risk is not.
- Count non-human privilege in the same scorecard. Service accounts in tier zero groups and pipeline credentials with admin rights are often the largest share of standing privilege.
- Keep the set to around ten and stable. Trends over four quarters are what let directors judge progress; changing definitions resets the story.
- Every red needs an owner and a decision. A board metric that cannot trigger funding, an exception decision or a risk acceptance is an operational metric in the wrong pack.
What the board needs from PAM metrics
Directors are not asked to run PAM; they are asked to oversee whether privileged access risk is within appetite. In the United States, listed companies must describe the board's oversight of risks from cybersecurity threats and management's role in assessing and managing them in the annual report under Regulation S-K Item 106, so the evidence behind that oversight matters. In the UK, the NCSC Cyber Security Toolkit for Boards frames oversight around risk management, strategy, people, incident planning and assurance. NIST SP 800-55 Volume 1 (December 2024) gives a method for selecting and prioritising measures; use it to document why each measure below was chosen.
Three questions shape a useful PAM board set:
- Exposure: how many identities, human and non-human, could take control of the systems that control everything else today?
- Reduction: is standing privilege being replaced by time-bound, verified access, and is that holding?
- Response: when a privileged credential is exposed, how quickly is it made useless? Microsoft's privileged access strategy sets the ambition of reducing mean time to remediate privileged access incidents towards zero.
KPIs, KRIs and operational metrics
| Level | Purpose | PAM examples | Audience and cadence |
|---|---|---|---|
| KRI | Shows exposure against appetite; rising values trigger escalation | Paths to tier zero, privileged non-human identities with interactive logon, overdue exceptions | Board or risk committee, quarterly |
| KPI | Shows whether the programme is delivering the outcome it was funded for | Share of tier zero roles that are just-in-time, time to contain an exposed privileged credential | Board or executive committee, quarterly |
| Operational metric | Shows whether a tool or process is running correctly | Vault coverage, rotation failures, session review backlog, connector health | Identity team and CISO, weekly or monthly; see the PAM Vault Health Check |
The distinction is explained in more depth in KRI vs KPI in Cyber Security. A practical test: if the number moved by 20%, would a director ask a different question or approve a different decision? If not, it belongs in the operational pack.
The board scorecard: ten PAM KPIs and KRIs
Each formula states numerator and denominator. Report both, not only the percentage, so a shrinking denominator cannot flatter the result. "Tier zero" means identities and systems that control identity infrastructure, the PAM or secrets platform itself, or the management of every other system: the control plane in Microsoft's enterprise access model.
| ID | Measure | Type | Formula | Why the board cares |
|---|---|---|---|---|
| PAMB-01 | Standing tier zero privilege | KRI | Count of human and non-human identities holding tier zero rights permanently, excluding sealed break-glass accounts, at period end | Each one is a credential that gives full control the moment it is stolen |
| PAMB-02 | Paths to tier zero | KRI | Count of identities that can reach tier zero control through group nesting, delegated permissions, owner rights, credential exposure on shared hosts or cloud role chaining, from attack path analysis | Shows hidden privilege that admin group counts miss |
| PAMB-03 | Just-in-time share of high-impact roles | KPI | Assignments to roles on the [high-impact role list] that are eligible and time-bound / all assignments to those roles (human and non-human) | The clearest measure of standing privilege being removed rather than relabelled |
| PAMB-04 | Phishing-resistant privileged sign-ins | KPI | Interactive sign-ins to privileged roles or admin accounts using a phishing-resistant method / all such sign-ins in the period | Phishing and MFA fatigue remain common routes to admin access |
| PAMB-05 | Privileged non-human identities with interactive capability | KRI | Service accounts, application identities and pipeline identities with tier zero or tier one rights that can sign in interactively or hold a static password or key / all privileged non-human identities | A machine credential that a person can also use is the easiest privilege to abuse quietly |
| PAMB-06 | Shared privileged accounts | KRI | Privileged accounts used by more than one named person in the period, excluding break-glass, from sign-in and check-out records | Shared accounts break accountability and make investigations inconclusive |
| PAMB-07 | Time to contain an exposed privileged credential | KPI | Median and 90th percentile hours from detection of a suspected exposure (leak, compromise alert, threat report) to the credential being disabled or rotated and its sessions revoked | Tests whether the organisation can act, not just detect |
| PAMB-08 | Third-party privileged access that expires | KPI | Supplier and contractor privileged accounts with an end date no more than [90] days away and a named internal sponsor / all supplier and contractor privileged accounts | Supplier access is a recurring route into administrative tools |
| PAMB-09 | Tested detection of privileged misuse | KPI | Priority privileged attack techniques with a detection tested in the last six months / priority techniques on the threat list (for example T1078 Valid Accounts, T1558.003 Kerberoasting, T1552.001 Credentials In Files) | Shows whether monitoring would catch the attacks that lead to privileged takeover |
| PAMB-10 | Privileged exception debt | KRI | Count of approved PAM exceptions past their expiry date, plus the oldest exception's age in days | Exceptions are where standing privilege hides once the headline numbers improve |
Two of these overlap with the capability measures in the PAM Maturity Model (standing privilege and phishing-resistant MFA); here they are reported as board outcomes with appetite thresholds. None of the vault operating measures are repeated.
Thresholds and risk appetite
The thresholds below are NHI Mgmt Group suggestions for an organisation that has reached a defined PAM programme. Set your own with the risk committee, record them in the risk appetite statement, and keep them fixed for at least four quarters.
| ID | Green | Amber | Red |
|---|---|---|---|
| PAMB-01 | Approved named list only, no growth quarter on quarter | Growth with change records | Any unexplained addition |
| PAMB-02 | Falling each quarter, every remaining path has an owner | Flat | Rising, or any path from a standard user account |
| PAMB-03 | 95% or above | 80% to below 95% | Below 80% |
| PAMB-04 | 100% for tier zero, 98% or above overall | 90% to below 98% overall | Below 90%, or any tier zero sign-in without it |
| PAMB-05 | Below 5% and none in tier zero | 5% to 15% | Above 15%, or any in tier zero |
| PAMB-06 | Zero | Known, with a dated plan | Any without a plan |
| PAMB-07 | Median under 4 hours, 90th percentile under 24 | Median 4 to 24 hours | Median over 24 hours |
| PAMB-08 | 100% | 95% to below 100% | Below 95% |
| PAMB-09 | 90% or above | 70% to below 90% | Below 70% |
| PAMB-10 | Zero overdue | Overdue, all under 90 days | Any overdue more than 90 days |
Report a red with three things: the cause, the owner and the decision requested (funding, an exception, a risk acceptance or a deadline). That turns the scorecard into the governance evidence boards are increasingly asked to show.
Where the numbers come from
| Measure | Primary data source | Cross-check |
|---|---|---|
| PAMB-01, PAMB-03 | Directory and cloud role assignment exports (permanent versus eligible), PAM role catalogue | Privileged role catalogue; see the Privileged Role Catalogue Template |
| PAMB-02 | Attack path or identity graph analysis across directory, cloud and endpoint data | Manual sample of the top ten paths each quarter |
| PAMB-04 | Identity provider sign-in logs filtered to privileged roles and admin accounts | Authentication method registration reports |
| PAMB-05 | Service account inventory joined to logon type data and credential type | Service Account Inventory Template |
| PAMB-06 | Vault check-out records and sign-in logs joined to HR identities | Help desk and change tickets |
| PAMB-07 | Incident and case management timestamps | Credential disable and rotation timestamps from the directory, cloud or secrets platform |
| PAMB-08 | Supplier access register and directory guest or contractor accounts | Procurement contract end dates |
| PAMB-09 | Detection engineering test records (purple team, breach and attack simulation) | SIEM rule inventory |
| PAMB-10 | GRC exception register | Original approval records |
Building the reporting
- Agree definitions first: write each measure into a metrics dictionary with owner, formula, source, exclusions and refresh date. The Security Metrics Dictionary Template gives the format.
- Agree what tier zero means: publish the high-impact role list and the tier zero system list, because PAMB-01, 02, 03 and 05 depend on them. See the Tiered Administration and Enterprise Access Model Guide.
- Baseline for one quarter without targets: collect the numbers, fix data quality, and expect the first baseline to be worse than anyone believed, especially for non-human identities.
- Set thresholds with the risk committee: link each to the appetite statement and to a decision owner.
- Automate collection: extract from source systems on a schedule into one store; manual spreadsheets drift and cannot be audited.
- Pilot the pack: show it to the audit or risk committee once before the full board, and remove anything that did not prompt a question.
- Review annually: retire a measure only when it has been green for four quarters and replace it with the next exposure; keep the old series in an appendix so the trend is not lost. If a definition must change, restate the prior quarters.
Choosing measures for your organisation
- Small organisations: start with PAMB-01, 04, 06 and 07. They can be calculated from identity provider and directory exports without a PAM platform. See PAM for Small Businesses.
- Mid-sized organisations with a PAM platform: add PAMB-03, 05, 08 and 10. Non-human privilege usually becomes the largest risk at this stage.
- Large or regulated organisations: use all ten, add PAMB-02 from attack path analysis, and split results by business unit or legal entity where boards are separate.
- Heavy cloud and DevOps estates: weight PAMB-05 and PAMB-03 towards cloud roles and pipeline identities; the NHI Programme Metrics page covers non-human outcomes in more depth.
Framework mapping
| Measure | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 | NCSC secure system administration principle |
|---|---|---|---|
| PAMB-01, PAMB-03 | PR.AA-05 | AC-6, AC-6(5), AC-2 | Use privileged access management |
| PAMB-02 | PR.AA-05 | AC-6, AC-6(7) | Risk manage administration using tiers |
| PAMB-04 | PR.AA-05 | IA-5 | Protect your administration interfaces |
| PAMB-05, PAMB-06 | PR.AA-05 | AC-2, IA-5 | Use privileged access management |
| PAMB-07, PAMB-09 | DE.CM-03 | AC-6(9), AU-14 | Log and audit administration activities |
| PAMB-10 and the scorecard as a whole | GV.OV-03, ID.IM-01 | AC-6(7) | Risk manage administration using tiers |
Common failure patterns
- Onboarding counts as success: "accounts in the vault" rises every quarter while permanent tier zero membership stays the same.
- Humans only: the scorecard covers administrators, while service accounts in Domain Admins and pipeline identities with owner rights are left out of PAMB-01 and PAMB-05.
- Just-in-time that is not: PAMB-03 reaches 100% because every role is "eligible", with eight-hour auto-approved activations. Report activation volume and duration alongside it.
- Recovery paths ignored: privileged MFA coverage is green while help desk resets for administrators use the standard process. In the MGM Resorts Breach 2023, the attackers said a help desk call led to identity provider administrator access.
- Credentials left where attackers look: PAMB-01 looks healthy but admin credentials sit in scripts and shares, so PAMB-02 is undercounted. In the Uber Breach 2022, the attacker claimed to have found hard-coded admin credentials in a script, which Uber did not confirm.
- Moving definitions: tier zero is redefined to exclude awkward systems, and the trend improves overnight.
Practitioner checklist
- Publish the tier zero system list and high-impact role list, with an owner.
- Write all ten measures into a metrics dictionary with formula, source and exclusions.
- Include non-human identities in PAMB-01, 03 and 05 from the first baseline.
- Agree thresholds with the risk committee and link them to the risk appetite statement.
- Automate extraction from the directory, cloud, identity provider, PAM and ticketing systems.
- Report numerator and denominator for every percentage.
- Attach cause, owner and decision requested to every red.
- Keep the operational vault measures in the health check, not the board pack.
- Review the set annually and restate history when a definition changes.
Standards and references
- NIST: SP 800-55 Vol. 1 Measurement Guide for Information Security
- NIST: Cybersecurity Framework 2.0
- NIST: SP 800-53 Rev. 5 Security and Privacy Controls
- NCSC: Secure system administration
- NCSC: Cyber Security Toolkit for Boards
- SEC: Cybersecurity risk management, strategy, governance and incident disclosure rules
- Microsoft Learn: Privileged access strategy
- Microsoft Learn: Enterprise access model
Related NHI Mgmt Group resources: PAM Maturity Model, PAM Vault Health Check, Privileged Access Management Guide, Board Cyber Risk Reporting Guide, Identity Security Metrics Guide.