Zero Standing Privilege (ZSP) means powerful access is not permanently attached to a person. Elevation is requested, approved (or policy-approved), time-bound, and revoked automatically when the task ends.
Why it matters: standing admin is the blast radius. Attackers and insider threats prefer accounts that are always powerful. ZSP shrinks that window and improves auditability.
Implementation pattern:
- Classify privileged entitlements and remove them from birthright roles.
- Offer JIT elevation via PAM or cloud IAM with MFA and reason codes.
- Default TTL measured in hours, not months; require re-approval to extend.
- Record sessions or at least command/API audit trails.
- Certify eligibility often; revoke standing leftovers during campaigns.
Use the certification practice again below — several items hinge on recognizing standing privilege that should be revoked in favor of JIT.