API 1164

Protect (PR): access control, training, data security, protection processes, maintenance, protective technology (Section 7) – API 1164

API 1164 PR.AC-6: PR.AC-6 Non-repudiation, identity proofing and binding of digital identities to real identities

The plan must require risk-appropriate access non-repudiation protections and identity proofing, and the binding of assigned unique digital identities (non-shared accounts, tokens, session keys) to real-life identities; at the Enhanced Profile automated mechanisms assert identities in asset and system interactions (SAML, Kerberos tickets, tokens, session keys).

Maintained by Gerard BlokdykControl text last updated 21 May 2026

Other controls in Protect (PR): access control, training, data security, protection processes, maintenance, protective technology (Section 7) – API 1164

PR.AC-1 PR.AC-1 Identity lifecycle management for human, device and process accounts; authentication on every interface
PR.AC-2 PR.AC-2 A physical security plan for sites with IAC cyber assets, aligned to the highest profile present
PR.AC-3 PR.AC-3 Nonlocal access managed: boundaries, approvals, failed logons, session control, emergency access and log retention
PR.AC-4 PR.AC-4 Role-based authorisation with least privilege and segregation of duties
PR.AC-5 PR.AC-5 Network integrity through security zones and conduits with maintained architecture diagrams
PR.AC-7 PR.AC-7 Risk-appropriate and consistent authentication strength within a segregated environment
PR.AT-1 PR.AT-1 Cybersecurity training for all IAC users before access and periodically, including emergency behaviour
PR.AT-2 PR.AT-2 Training for high-privileged account users before administering any environment

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All API 1164 controls