Once identified, each of your privileged accounts should be placed into a risk category and mapped to their appropriate security controls. Keep in mind that not all privileged accounts are equal, some likely have much more risk than other accounts. It is important to know which accounts have the greater impact on your business if they are ever compromised. Assessing the risk of each account enables you to effectively prioritize which accounts to secure and manage with the corresponding privileged access security. 

For privileged accounts, include information on how you evaluate risk. You may develop your own threat classification or risk ranking system to determine the level of risks to your business operations. We have included the sample system below as a guideline.