Privileged Access Management Starter Plan
Control and monitor administrator access.
The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.
[VERIFY] is an editorial flag, not a blank to fill. Wherever the prompt shows [VERIFY], check that item against a reliable source before you use it.
Design a starter plan for managing privileged access. Admin accounts and systems: [ADMIN_ACCOUNTS]. Tools available: [TOOLS]. Compliance drivers: [COMPLIANCE_DRIVERS]. Define principles: separate admin and daily accounts, just-in-time elevation, approvals, session logging, and break-glass accounts. Provide a roadmap for 90 days in three phases with specific deliverables, an inventory template for privileged accounts, and an operating procedure for emergency access including how it is sealed, tested and reviewed. List the logs to centralise and five alerts to build. Include risks, such as lockout, and mitigations. Mark compliance requirements [VERIFY] against the actual standard text. Add a set of success criteria for each 30-day phase and a description of tests such as a quarterly emergency access exercise. Include a table of the privileged account types in a typical small organisation and the minimum controls for each, and a list of reporting lines for alerts on privileged activity. Add a worked inventory of ten privileged account types for a small organisation (domain admin, cloud root, database admin, backup admin, firewall admin, SaaS global admin, service accounts, break-glass, vendor support, deployment pipeline) with owner, current control, target control and phase. Provide the break-glass procedure in numbered steps: where the credential is sealed, who may open it, what is logged, how soon the account password is changed afterwards, and how the opening is reviewed. Add five alert definitions in plain language (admin login outside working hours, new admin account, privilege added to a group, break-glass used, sign-in failure bursts) with the response expected for each. End with a monthly metric set: privileged accounts, accounts with standing access, and time to revoke. End with a first-week task list of five things to do before buying any tool: inventory the accounts, name an owner for each, remove unused ones, enable stronger sign-in, and turn on logging. Everything should help me defend and recover. If I ask for something that could be used to harm others, decline it and suggest a safer defensive route.
Fill in before use
Optional: type your details and the prompt above updates. Nothing is saved or sent.
Replace each bracketed placeholder with your own details, then paste into Any AI or another assistant.
See an example result (fictional data)
Principles: separate admin and daily accounts; just-in-time elevation; session logging; break-glass accounts. Roadmap 0-30 days: inventory admin accounts (found 9, 3 unused); remove unused; separate daily accounts. 31-60 days: central logging for admin actions; approvals for elevation. 61-90 days: break-glass test. Break-glass: two sealed accounts, tested quarterly, any use reviewed. Alerts: new admin created, admin login outside hours, disabled logging, repeated failures, privilege change. Risk: lockout. Mitigation: break-glass tested before enforcement. Compliance requirements [VERIFY]. Success check at day 90: zero shared admin accounts, all admin actions logged, and one successful break-glass test.
Illustrative only, made-up data. Your results will differ and must be reviewed.