What is Zero Standing Privilege (ZSP)?
Zero Standing Privilege (ZSP) is a security principle that eliminates permanently assigned elevated accounts, requiring all privileged access to be granted on demand and revoked when the task is complete. It is designed to shrink the window of opportunity an attacker has to misuse a privileged credential.
What it is
Zero Standing Privilege is a design principle, not a product. It states that no user, service account, or machine identity should hold elevated permissions at rest. Instead, privilege is requested, approved, issued for a defined period, and then automatically revoked. The moment a session ends, the access disappears.
This is a stricter extension of the least-privilege principle. Least privilege limits how much access an account holds. ZSP goes further and says that account should hold no standing access at all.
The mechanism that delivers ZSP in practice is Just-in-Time (JIT) access provisioning. A user authenticates, requests a specific role or credential, receives it for the duration of a task, and the system revokes it automatically. PAM platforms are the most common tools used to enforce this pattern.
Why it matters
Persistent privileged accounts are a primary target in breaches. An attacker who compromises a standing admin account can move laterally, escalate further, and persist for weeks. If that account never holds privilege outside an active session, the stolen credential is nearly worthless.
ZSP also reduces the blast radius of insider threats. A malicious or negligent insider cannot abuse access they do not currently hold.
Compliance frameworks including SOC 2, ISO 27001, and NIST 800-53 push organizations toward least-privilege and time-limited access. ZSP satisfies those controls more completely than static role assignments.
How tools address it
Privileged Access Management (PAM) platforms are the primary enforcement layer for ZSP. They can:
- Issue time-boxed credentials that expire after a session
- Rotate passwords or secrets immediately after use
- Require approval workflows before granting elevated access
- Record and audit every privileged session
- Inject credentials directly into sessions so the user never sees the password