Belgium CyberFundamentals BE-CF-02: Access enforcement and least privilege

What else in your programme already covers this

This control maps to 27 controls across 10 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

API 1164 · 3 controls

API1164-06 Access Control
API1164-07 Remote Access
API1164-09 Patch and Vulnerability Management

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association) · 3 controls

AWWA-1.3 Security Awareness and Training
AWWA-2.1 User Access Management
AWWA-2.4 Physical Access Controls

ASD Strategies to Mitigate Cyber Security Incidents · 2 controls

ASD37-18 Restrict administrative privileges (Essential)
ASD37-20 Multi-factor authentication (Essential)

ISO/IEC 27010:2015 · 2 controls

27010-9.1 Access Control to Shared Information
27010-9.2 Authentication of Sources

ISO/IEC 27011:2024 · 2 controls

27011-5.3 Segregation of duties
27011-8.1 User Endpoint Devices

APPI · 1 control

APPI-A26 Report of Leakage to the Commission and Notification to the Person

IEC 62351 - Power Systems Communication Security · 1 control

62351-8 Role-based access control (RBAC)

ISO/IEC 27400:2022 · 1 control

27400-6.1 Secure Device Design

NIST Cybersecurity Framework 2.0 · 1 control

NIST-CSF-PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties

US Automated Commercial Environment (ACE) - CBP Trade Data Requirements · 1 control

ACE-CR-4 Cargo Release Authorization

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.