PAM 25-2-7 — Army Information System Privileged Access
PAM 25-2-7 governs Privileged Access Agreements for privileged users' acceptance of Army cybersecurity responsibilities.
- Publication number: PAM 25-2-7
- Title: ARMY INFORMATION SYSTEM PRIVILEGED ACCESS
- Date: 04/08/2019
- Proponent: G-6
- Status: ACTIVE
View PAM 25-2-7 on armypubs.army.mil
Related publications
It addresses elevated access accounts, separation of duties, least privilege, DD Form 2875 requests, denials, resubmissions, oversight, and monitoring. It requires agreements, cybersecurity training and certification, access justification, quarterly revalidation, and corrective action when privileges cannot be validated.
Topics covered
- Privileged Access Agreements
- Elevated access accounts
- Separation of duties
- Least privilege
- DD Form 2875 requests
- Privileged access denials
- Quarterly privilege revalidation
- ATCTS monitoring
Questions and answers
Who must sign a Privileged Access Agreement?
Individuals requiring elevated access to system control, monitoring, administration, criminal investigation, and/or compliance functions must sign a PAA. (paragraph 2-1)
Which form is used to request privileged access?
Request privileged access using DD Form 2875 (System Authorization Access Request (SAAR)). (paragraph 3-1)
Who authorizes or denies privileged access requests?
The Information System Security Manager (ISSM) or Information System Security Officer (ISSO) who oversees the local cybersecurity program will authorize or deny requests for privileged access before forwarding to the Network Enterprise Center (NEC) or designated service provider. (paragraph 3-1)
How often must privileged access users be revalidated?
Commands and other Army ISSOs and ISSMs will revalidate all users with privileged access on a quarterly basis. (paragraph 4-1)
What happens when the need for assigned privileges cannot be revalidated?
If the need cannot be revalidated, organizations will take appropriate corrective actions. (paragraph 4-1)