Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 CCM-IAM-16: Authorization Mechanisms

What else in your programme already covers this

This control maps to 50 controls across 23 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

AWS Well-Architected Security Pillar · 5 controls

SEC02-BP06 Employ user groups and attributes
SEC03-BP05 Define permission guardrails for your organization
SEC03-BP07 Analyze public and cross-account access
SEC03-BP08 Share resources securely within your organization
SEC08-BP04 Enforce access control

PCI DSS 4.0 · 5 controls

7.2.1 7.2.1 Access control model defined
7.3.2 7.3.2 Access control system enforces role-based permissions
7.3.3 7.3.3 Access control default deny all
7.2.6 7.2.6 Query access to stored cardholder data restricted
7.3.1 7.3.1 Need-to-know access control system covers all components

Australia My Health Records Act 2012 · 4 controls

MYHR-CUD-2 Prohibition on unauthorised collection, use and disclosure
MYHR-SEC-2 Access controls and user account management
MYHR-SEC-6 Emergency access controls
MYHR-SEC-7 Consumer access controls and consent

Azure Security Benchmark · 3 controls

ASBv3-IM-9 Secure user access to existing applications
ASBv3-PA-7 Follow just enough administration (least privilege) principle
IM-7 Restrict resource access based on conditions

C5 (Germany) · 3 controls

C5-COS-04 Cross-network access
C5-PSS-06 Session Management
C5-PSS-09 Authorisation Mechanisms

CIS Controls v8 · 3 controls

CIS-3.3 Configure Data Access Control Lists
CIS-6.7 Centralize Access Control
CIS-6.8 Define and Maintain Role-Based Access Control

NIST SP 800-53 Rev 5 · 3 controls

NIST800-AC-24 AC-24 Access Control Decisions
NIST800-AC-3 AC-3 Access Enforcement
NIST800-IA-13 IA-13 Identity Providers and Authorization Servers

CMMC 2.0 · 2 controls

AC.L2-3.1.1 Authorized Access Control
AC.L2-3.1.2 Transaction & Function Control

HIPAA Security Rule · 2 controls

164.308(a)(4)(ii)(B) Access Authorization (Addressable)
164.312(a)(1) Access Control (Standard)

ISO 27001:2022 · 2 controls

5.15 Access control
8.3 Information access restriction

ISO 27002:2022 · 2 controls

5.15 Access control
8.3 Information access restriction

NIST SP 800-161 Rev 1 · 2 controls

161R1-AC-24 Access Control Decisions
161R1-AC-3 Access Enforcement

NIST SP 800-171 Rev 3 · 2 controls

03.01.02 Access Enforcement
03.08.02 Media Access

NIST SP 800-66 Rev 2 · 2 controls

164.308(a)(4)(ii)(B) Access Authorization (Addressable)
164.312(a)(1) Access Control (Standard)

SOC 2 · 2 controls

SOC2-CC6.1 CC6.1 Logical access security over protected information assets
SOC2-CC6.3 CC6.3 Role-based access, least privilege and segregation of duties

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 1 control

ANSSI-HYG-09 Assign the Correct Rights on Sensitive Resources

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.1 · 1 control

IAM-15 Authorization Mechanisms

DORA · 1 control

DORA-Art.9 Protection and prevention

FedRAMP High · 1 control

AC-3 Access Enforcement

ISO 27701:2019 · 1 control

6.6.4 System and application access control

NIST Cybersecurity Framework 2.0 · 1 control

NIST-CSF-PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties

UK Cyber Essentials · 1 control

CE-AC.4 Privileged Account Approval and Tracking

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 have you already done?

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 CCM-IAM-16 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 140 of 197 Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 controls already carry evidence.

If you hold NIST SP 800-53 Rev 571.1% covered · 57 gaps If you hold FedRAMP Moderate60.4% covered · 78 gaps If you hold PCI DSS 4.060.4% covered · 78 gaps If you hold C5 (Germany)58.4% covered · 82 gaps If you hold ISO 27001:202256.3% covered · 86 gaps If you hold ISO 27002:202256.3% covered · 86 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 12 were rejected on the NIST SP 800-53 Rev 5 pair alone.

See the released pairs, $299 each Browse the graph free