PAM Evidence Coverage
Audit privileged-access-management evidence.
Description
Privileged-access management needs evidence about high-permission accounts and their controls.
Privileged-access management needs evidence about high-permission accounts and their controls. Checklist coverage differs from control testing.1
Audit privileged-access-management evidence.
When to use PAM Evidence Coverage
Use this tool to audit privileged-access-management evidence.
Prepare the documented facts, aligned totals or expected/observed evidence labels requested. Choose applicable requirements and thresholds separately before interpreting a planning screen.
How to use PAM Evidence Coverage and understand its results
- Prepare the documented facts, aligned totals or expected/observed evidence labels requested. Choose applicable requirements and thresholds separately before interpreting a planning screen.
- Enter requiredEvidence, availableEvidence using the field table and calculation rules, then run the tool.
- Read coveragePercent, matched, missing, unexpected. The explanation below defines the units, signs, ordering and any flags or placeholder values.
- If the tool reports an input issue, correct the values and run it again. Apply the stated assumptions when interpreting a successfully returned result.
| Input field | Meaning | Value type; see rules below | Requirement |
|---|---|---|---|
| requiredEvidence | Required PAM evidence | list of string | Required |
| availableEvidence | Available evidence | list of string | Required |
Enter requiredEvidence as the nonempty expected list and availableEvidence as observations, which may be empty. Trim entries, compare case-insensitively using en-US lowercase and collapse duplicates. Return matched/missing expected labels and unexpected observed labels. Output follows first occurrence order with the last duplicate’s trimmed spelling.
coverage%=100matchedUnique/expectedUnique Units, indexing, boundary conditions and exceptional cases are defined in the calculation rules above.
| Output field | Meaning | Value type |
|---|---|---|
| coveragePercent | Coverage (%) | number; minimum: 0; maximum: 100 |
| matched | Matched items | list of string |
| missing | Missing items | list of string |
| unexpected | Unexpected items | list of string |
{
"input": {
"requiredEvidence": [
"alpha",
"beta",
"gamma",
"delta"
],
"availableEvidence": [
"beta",
"alpha",
"extra"
]
},
"output": {
"coveragePercent": 50,
"matched": [
"alpha",
"beta"
],
"missing": [
"gamma",
"delta"
],
"unexpected": [
"extra"
]
}
}Limitations and assumptions
No credentials, access logs or privileged sessions are inspected. Blank entries are errors; requirements are entirely caller-supplied and items have equal weight.
Numeric inputs, where present, must be finite. Follow the calculation-specific rules for overflow, underflow and exceptional cases. Lists are limited to 100,000 entries; the rules above may require smaller limits. Missing required fields, extra fields, wrong value types and violations of the calculation rules are input errors.
Alternative or Complementary methods
Use Log Retention Evidence Check: Compare caller-supplied expected and observed records for log retention evidence check. For a complementary task, use Token Rotation Due: Calculate API token rotation due date and overdue status.
References
-
PAM Evidence Coverage — tool.io
Similar or alternative tools
- Log Retention Evidence Check
Compare caller-supplied expected and observed records for log retention evidence check.
- Token Rotation Due
Calculate API token rotation due date and overdue status.