Company
Support
Login
Book a Demo
Contact Us
View Categories

Zero Standing Privilege

ZERO STANDING PRIVILEGE
What is Zero Standing Privilege (ZSP) and how is it anchored in standards?
Privilege without a timer is the real vulnerability, not the person holding it. Zero Standing Privilege (ZSP) means access does not exist between sessions. Every session is requested, evaluated against current policy, opened for a bounded window, and revoked at close. The control surface moves from credential possession to session lifecycle. ZSP is anchored in two places. NIST SP 800-207 Tenet 3 states that access to individual enterprise resources is granted on a per-session basis. Tenet 6 requires that all resource authentication and authorisation are dynamic and strictly enforced before access is allowed. IEC 62443-3-3 SR 2.6 requires the system to terminate a remote session either by user action or after an inactivity period; SR 2.1 requires authorisation enforcement for all human users to support segregation of duties and least privilege.
FIGURE 3. Standing privilege vs. Zero Standing Privilege Two access models on a 24-hour timeline. Vendor-neutral. A. STANDING PRIVILEGE access exists by default · continuously valid · no session boundary Access state ACCESS GRANTED · ALWAYS-ON · 24/7 0 h 12 h 24 h Risk profile Persistent attack surface Credential reuse risk No approval gate No revocation event Audit trail incomplete Result: access exists 24 h/day, used ~7 h/day · attack surface = 100% of the day B. ZERO STANDING PRIVILEGE (ZSP) closed by default · granted per session · then revoked Access state CLOSED (default) SESSION OPEN · APPROVED · TIME-BOUND CLOSED · REVOKED 1 Request 2 Approval 3 Session open 4 Session closed 5 Access revoked Evidence trail Request ticket Approval log Session recording + keystroke log Teardown entry Revocation event Result: access exists ~7 h/day · attack surface 7/24 · every transition produces evidence
Figure 3. Standing privilege (always on) compared to Zero Standing Privilege (a single bounded window with five labelled transitions: Request, Approval, Session open, Session closed, Access revoked). Anchors: NIST SP 800-207 Tenets 3 and 6; IEC 62443-3-3 SR 2.1, SR 2.6.