Frameworks / Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 / CCM-IAM-13 Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1
IAM - Identity & Access Management
Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 CCM-IAM-13: Uniquely Identifiable Users Give every user a unique identifier, or otherwise be able to tie the use of an account back to a named individual.
Maintained by Gerard Blokdyk · Control text last updated 19 August 2026 What else in your programme already covers this This control maps to 51 controls across 25 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
AC-2(9) Restrictions on Use of Shared and Group Accounts IA-2 Identification and Authentication (Organizational Users) IA-2(5) Identification and Authentication (Organizational Users) | Individual Authentication with Group Authentication (IA-2(5)) IA-4 Identifier Management IA-8 Identification and Authentication (Non-Organizational Users) AC-2(9) Restrictions on Use of Shared and Group Accounts IA-2 Identification and Authentication (Organizational Users) IA-2(5) Identification and Authentication (Organizational Users) | Individual Authentication with Group Authentication (IA-2(5)) IA-4 Identifier Management IA-8 Identification and Authentication (Non-Organizational Users) MYHR-REG-11 Ensuring required information is given to the System Operator MYHR-REG-2 Healthcare recipient registration and identity verification MYHR-SEC-3 Audit logging and access monitoring 8.2.1 8.2.1 Unique ID assigned to every user 8.2.2 8.2.2 Shared and generic IDs only by exception 8.2.3 8.2.3 Service provider unique factors per customer ASBv3-IM-5 Use single sign-on (SSO) for application access IM-1 Use centralized identity and authentication system CIS-5.1 Establish and Maintain an Inventory of Accounts CIS-5.2 Use Unique Passwords NIST-CSF-PR.AA-01 Identities and credentials for authorized users, services, and hardware are managed by the organization NIST-CSF-PR.AA-02 Identities are proofed and bound to credentials based on the context of interactions 161R1-IA-2 Identification and Authentication (Organizational Users) 161R1-IA-8 Identification and Authentication (Non-Organizational Users) CE-AC.2 Authenticate Users Before Granting Access CE-SC.4 Authenticate Users Before Access E8-ADMIN-ML1 Restrict Administrative Privileges (ML1) ANSSI-HYG-08 Identify Each Person by Name and Separate User and Administrator Roles ASD37-21 Disable local administrator accounts (Excellent) SEC02-BP04 Rely on a centralized identity provider AUCDR-IS-1 Limit risk of unauthorised access to the CDR data environment 6.6.2 User access management SOC2-CC6.2 CC6.2 Registering and authorising users before issuing credentials Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in IAM - Identity & Access Management You are reading one control. How much of Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 have you already done? Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 CCM-IAM-13 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 140 of 197 Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 12 were rejected on the NIST SP 800-53 Rev 5 pair alone.
Query this from an agent The graph holds this control, the 51 it maps to, and the evidence behind each claim, over MCP and REST.