• Privileged and service-account credentials are vaulted and rotated in a privileged access management (PAM) solution; local administrator passwords are uniquely managed.
• Elevated-privilege accounts are audited and aligned to least privilege.
• Credential hygiene is audited against known breach datasets, and compromised credentials are rotated.

Framework Alignment: NIST CSF PR.AA; CIS Control 5, 6; GDPR Art. 32; ISO 27001:2022 A.8.2, A.5.17