Due to system constraints, a group of system administrators must share a high-level access set of credentials. Which of the following would be MOST appropriate to implement?

Increasing console lockout times for failed logon attempts reduces security rather than improving accountability, as it makes the system more permissive to brute-force attempts and does nothing to track who is using the shared credentials.

Reducing the group size limits exposure but does not solve the core problem of shared credential accountability, as even a smaller group sharing credentials still lacks individual auditability and non-repudiation.

A credential check-out process implements a Privileged Access Management (PAM) control that assigns temporary, auditable access to shared credentials on a per-use basis. This maintains accountability even when credentials are shared, as each check-out is logged to a specific administrator with a timestamp, preserving a chain of custody. It directly addresses the risk of shared credentials by ensuring non-repudiation without requiring a complete architectural overhaul.

Full logging on affected systems provides forensic data after the fact but does not control or attribute who checked out and used the shared credentials in real time, making it a detective rather than a preventive or accountability control.