IT Governance Business Case
Privileged Access Management (PAM) for Technology Solutions
Technology Solutions
Background
The City of Durham operates a complex IT environment with numerous systems requiring privileged access, used by IT staff, vendors, contractors, and automated services. This access includes sensitive data, critical infrastructure, and administrative control over citywide systems.
Currently, vendors fill out a form online with questions such as the specific endpoint(s) the vendor needs, which is later approved by our Cybersecurity team.
There is no centralized access management solution in place, and privileged access are often managed manually or through disparate tools with inconsistent policies.
Current Business Problem
Currently, privileged accounts are managed and polices are created manually, which is inefficient and can result in human error. The City's system administrators govern access from multiple, privileged accounts with different usernames and passwords. These accounts do not provide an audit trail and rely on users following manual processes to check in and out.
The organization faces increased risk of unauthorized access, reduced auditability of administrative actions, and difficulty meeting compliance requirements from frameworks such as the National Institute of Standards and Technology.
Current Pain Points
• No Centralized Control of Privileged Accounts
• Lack of Audit Capability
• Risk of Insider Threats and External Breaches
• Increased Compliance Risk
• Inefficient and Manual Access Processes
Future State Benefits
• Centralized Control of Privileged Access
• Full Auditability
• Stronger Protection Against Insider Threats and Cyber Attacks
• Improved Compliance Posture
• Operational Efficiency and Reduced IT Burden
Strategic Alignment
Analysis & Recommended Solution
Solution Analysis
A centralized, auditable access control system does not exist for the City's administrative accounts.
A Privileged Access Management (PAM) solution is a solution to the current business problem. It’s a security technology that controls, monitors, and protects privileged accounts and access within an organization. PAM provides visibility, control, and accountability.
Market research will be conducted to find viable PAM solutions.
Market Analysis
Available solutions from CyberArk, BeyondTrust, and Delinea have been evaluated. These vendors are recognized as Leaders in the 2025 Gartner Magic Quadrant for Privileged Access Management. Each vendor is considered highly capable and visionary in the PAM space because of their strong ability to execute and completeness of vision.
Based on current and anticipated requirements, it has been determined that moving forward with a formal Request for Proposal (RFP) is necessary to assess vendor capabilities and select a solution that best aligns with strategic objectives, budget considerations, and long-term needs of the City of Durham.
Recommended Solution: Issue an RFP to identify and implement a Privileged Access Management (PAM)
Description
Continue the selection process by initiating a request for proposals (RFP) to identify and implement a Privileged Access Management system
Pros
• Centralized Control of Privileged Access
• Improved Credential Security
• Full Visibility and Auditability
• Enforcement of Least Privilege and Just-in-Time Access
Cons
• N/A
TS Architecture Review
The identified solution will undergo the standard Architecture Review once a vendor is selected.
Cybersecurity Review
The identified solution will undergo the standard Cybersecurity Review once a vendor is selected.
Recommended Solution - Project Financial Estimate
Risk Identification
Mitigation Risk (Costs)
• N/A
Contingency Risk (Costs)
• N/A
Our ask
We are asking the IT Governance Steering Committee to approve and score the business case to identify and implement a Privileged Access Management system for Technology Solutions. If approved, the business case will be scored, ranked, and submitted to the City Manager for final approval.