Context
The core banking platform still ran on shared admin credentials — a pattern regulators have flagged since before cloud existed. Two attempts to fix it had failed for the same reason: the three people who run IT could not do their jobs without permanent access, so every proposed control was quietly worked around within weeks.
This is the position most community banks are in. The rules that apply are the rules that apply to institutions a hundred times the size, and the team expected to satisfy them fits around one table.
Regulatory driver
An open FFIEC finding on shared administrator credentials and separation of duties, read against the Authentication booklet and InfoBase VI.A.3 expectations for privileged-user authentication. The evidence had to answer a question about one admin action on one date — not a policy document asserting that the control exists.
What we did
Made the compliant path the easy one. Rather than fighting how the team already worked, we rebuilt around it: CyberArk Privilege Cloud issues credentials on request with a 15-minute window, approvals route to the IT manager on a phone, and every admin session on core systems is recorded. Requesting access is now faster than the workaround was.
Separation of duties moved into the system. The payment initiate/approve conflict became impossible to hold rather than something to catch later — a request that would combine both roles is blocked at the point it is made, instead of being found in a quarterly spreadsheet review.
Evidence collects itself. Every request, approval and recorded session writes the audit trail as it happens. The pre-review fire drill became a two-day export.
Result
Follow-up review: no identity findings. The question — “show me that this particular admin action was approved, limited and recorded” — now takes minutes to answer, for any action, at any point.
Scope note: this was one workstream over eight weeks, covering privileged access on the core platform and Active Directory. It was not a whole-bank security programme, and it was not sold as one.