Every user holds information access rights that match business requirements, coordinated with the business units that manage their own access rights inside processes: access rights follow the business function, process requirements and security policy, with identity and access management aligned to defined roles and responsibilities and to least privilege, need to know and need to have; every change to access rights (creating, modifying, deleting) is administered promptly on the basis of approved, documented transactions authorised by designated management; privileged accounts are kept separate, cut to the minimum needed and actively managed, with everything they do monitored; every information processing activity is uniquely identified by functional role, and roles are defined consistently across business units, including roles the business defines inside applications; all access is authenticated according to the individual's role or to business rules; every user, whether internal, external or temporary, and what each does in applications, infrastructure, operations, development and maintenance can be uniquely identified; an audit trail of access is kept according to sensitivity and regulatory requirements; and management reviews all accounts and privileges at regular intervals.
This control maps to 6 controls across 2 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 6 it maps to, and the evidence behind each claim, over MCP and REST.