Banking and financial services
Grant privileged access to servers and databases behind core banking and payments for a set window, with the access controls examiners commonly focus on.
Information only, not legal advice or a certification. Zerostand is not affiliated with or endorsed by any body named on this page, and the official framework text prevails. Mappings as at 14 October 2026. Full notice.
Six frameworks, one theme
BNM RMiT
S 10.54(c): time-bound access that restricts access to a specific period based on the nature of the work.
RBI Directions, 2026
Commercial Banks, para 105: personnel with elevated access closely supervised, with all their system activity logged and periodically reviewed.
APRA
Its letter of 15 August 2024 observed: "Privileged access to information assets is not always approved and granted based on a valid business need and for a specified time."
DORA RTS 2024/1774
Art. 21(e)(ii): privileged, emergency and administrator access assigned on a need-to-use or ad-hoc basis for all ICT systems.
PCI DSS v4.0.1
8.6.1: interactive use of system or application accounts only in exceptional circumstances, time-limited, justified, approved, with the individual confirmed and every action attributable.
Our short paraphrase of one control each (APRA: a quoted observation); the compliance page links the official text, which prevails.
The systems behind core banking and payments
- Oracle
- SQL Server
- Linux hosts
- Windows hosts
- FortiGate
Oracle and SQL Server accounts are discovered, vaulted, rotated, verified and reconciled. Linux and Windows sessions are brokered and recorded by default, and their local accounts rotated. FortiGate accounts can be discovered through a device platform you set up.
The capabilities behind the controls
Zero standing privilege
Grants of at most 30 days that end on their own.
Learn more →Approvals
Requests decided by the safe's approvers or an Admin, never the requester.
Learn more →Credential vault
The accounts you cannot remove yet, vaulted, rotated and verified.
Learn more →Session management
Linux and Windows sessions brokered and recorded by default.
Learn more →Emergency access
Break-glass for pre-listed people, with a reason and a time cap.
Learn more →Discovery and reviews
Find accounts outside any safe; recertify who holds access.
Learn more →Records your auditors can check
A verifiable audit log
Grants, sessions, reveals and rotations in a hash-chained, tamper-evident log you can verify.
A copy in your SIEM
Events forwarded by webhook or syslog when you configure it; the local log stays the record.
Session recordings
SSH, RDP and web sessions recorded by default and replayable; SSH can be watched live.
Recertification campaigns
Reviews with reminders and escalation, and exportable evidence of every decision.
Entitlements report
Who can reach which safe and by what route, as CSV.
Posture findings
Orphaned and unassigned accounts, and dormant or over-privileged workloads, flagged for remediation.
Questions banks ask
Does Zerostand make us compliant?
No product can make you compliant. Zerostand supports the controls; compliance stays your responsibility.
Can it run in our own data centre?
Yes. Zerostand runs as containers on infrastructure you control, on-premises or in your cloud. For resilience you can run an active and a standby node on PostgreSQL.
Where is our data stored?
On your infrastructure, where you deploy it. It goes elsewhere only to destinations you configure, such as your SIEM, email server or ticketing system.
Do you support Oracle?
Yes: Oracle accounts are discovered, vaulted, rotated, verified and reconciled. There are no short-lived Oracle logins or brokered Oracle sessions today.
Can vendors and outsourced staff use the same controls?
Yes. Third parties use the same requests, approvals, time-boxed access and recorded sessions as staff. Your team adds them as users, locally or through your identity provider; there is no vendor self-service onboarding.
See it on your own systems
Four weeks on your own servers and a database.