Virtus Group - Privileged Access Standard

Purpose

This standard defines baseline requirements for privileged access. It applies to Virtus Group personnel and approved third‑party administrators operating on behalf of clients.

Scope

Cloud control planes (Entra ID, Azure, M365)
Servers, endpoints and on‑prem infrastructure
Network and security devices

References

NZ Government PSR and NZISM privileged access guidance
Virtus Group Information Security Policy; Acceptable Use Policy

Mandatory controls

MFA everywhere: required for all privileged roles and jump paths.
Just‑in‑Time elevation: no standing admins; use approval workflow with time‑bound activation and expiry.
Break‑glass accounts: two per tenant; strong auth; monitored; quarterly tested; offline escrow.
Password rotation (LAPS): unique, automatically rotated local admin credentials; audited retrieval.
Secrets in a vault: store shared/service credentials, API keys and certificates; RBAC and audit logging mandatory.
Privileged Access Workstations (PAW): hardened devices or jump hosts; EDR, disk encryption, restricted internet.
Least privilege & time‑bound elevation: role‑based access; periodic re‑validation removes unused privileges.
Logging & retention: centralised logs; defaults: security 365d; admin/audit 180d.
Access reviews: quarterly review of privileged roles and vault access; exceptions time‑bound and risk‑accepted.

Recommended enhancements (on request)

Session brokering and recording for server/network administration
Automated rotation for service accounts and keys
Tiered admin model and restricted admin paths

Roles & responsibilities

Service Owner: approves roles; runs quarterly reviews; owns exceptions.
Administrators: use PAW/jump hosts; request JIT elevation; document high‑risk changes with backout.
Security: monitors privileged changes; investigates anomalies; maintains this standard.

Change management

Privileged changes follow CAB where required; before/after evidence attached to the ticket.
Break‑glass usage is an incident; PIR within 10 business days.
New privileged tools/vaults require security review prior to use.

Metrics & thresholds

No standing Global Administrator (target: 0)
Unreviewed privileged assignments < 90 days (target: 0)
Break‑glass test cadence (target: quarterly)
PAW adoption for admins (target: 100%)

Evidence artefacts

PIM configuration export and activation logs
LAPS policy and rotation audit
Vault access logs and secret rotation records
Quarterly privileged access review records
Break‑glass test report and alerting setup

Contact

security@virtusgroup.biz · compliance@virtusgroup.biz · virtusgroup.co.nz · 0800 847 887 (VIRTUS)