Frameworks / NIST Cybersecurity Framework 2.0 / NIST-CSF-PR.AA-05 NIST Cybersecurity Framework 2.0
PR - Protect
NIST Cybersecurity Framework 2.0 NIST-CSF-PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 509 controls across 168 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
10.3.1 10.3.1 Audit log read access limited to job need 10.6.3 10.6.3 Time sync configuration and time data protected 2.2.2 2.2.2 Vendor default accounts managed 3.4.2 3.4.2 Remote access blocks copying or relocating PAN 7.2.1 7.2.1 Access control model defined 7.2.2 7.2.2 User access assigned by job function and least privilege 7.2.3 7.2.3 Privileges approved by authorized personnel 7.3.2 7.3.2 Access control system enforces role-based permissions 7.3.3 7.3.3 Access control default deny all 8.2.2 8.2.2 Shared and generic IDs only by exception 9.2.3 9.2.3 Physical protection of network hardware and lines 9.4.1 9.4.1 Physical security of all media 9.4.4 9.4.4 Management approval for media leaving facility 3.6.1 3.6.1 Procedures protect keys against disclosure and misuse 6.5.4 6.5.4 Separate roles between production and pre-production 7.2.4 7.2.4 User accounts and privileges reviewed every six months 7.2.5 7.2.5 Application and system accounts least privilege 7.2.6 7.2.6 Query access to stored cardholder data restricted 7.3.1 7.3.1 Need-to-know access control system covers all components AC-2 Account Management AC-2(7) Privileged User Accounts AC-2(9) Restrictions on Use of Shared and Group Accounts AC-3 Access Enforcement AC-5 Separation of Duties AC-6 Least Privilege AC-6(1) Authorize Access to Security Functions AC-6(7) Review of User Privileges CA-9 Internal System Connections CM-12 Information Location (CM-12) CM-5 Access Restrictions for Change MA-3 Maintenance Tools (MA-3) MA-4 Nonlocal Maintenance PS-4 Personnel Termination PS-5 Personnel Transfer SC-18 Mobile Code AC-2 Account Management AC-2(7) Privileged User Accounts AC-2(9) Restrictions on Use of Shared and Group Accounts AC-3 Access Enforcement AC-5 Separation of Duties AC-6 Least Privilege AC-6(1) Authorize Access to Security Functions AC-6(7) Review of User Privileges CA-9 Internal System Connections CM-12 Information Location (CM-12) CM-5 Access Restrictions for Change MA-3 Maintenance Tools (MA-3) MA-4 Nonlocal Maintenance PS-4 Personnel Termination PS-5 Personnel Transfer SC-18 Mobile Code ASBv3-AM-4 Limit access to asset management ASBv3-DP-8 Ensure security of key and certificate repository ASBv3-GS-2 Define and implement enterprise segmentation/separation of duties strategy ASBv3-IM-9 Secure user access to existing applications ASBv3-PA-4 Review and reconcile user access regularly ASBv3-PA-5 Set up emergency access ASBv3-PA-7 Follow just enough administration (least privilege) principle IM-7 Restrict resource access based on conditions PA-1 Separate and limit highly privileged/administrative users PA-2 Avoid standing access for user accounts and permissions CIS-12.5 Centralize Network Authentication, Authorization, and Auditing (AAA) CIS-12.8 Establish and Maintain Dedicated Computing Resources for All Administrative Work CIS-13.5 Manage Access Control for Remote Assets CIS-3.3 Configure Data Access Control Lists CIS-5.1 Establish and Maintain an Inventory of Accounts CIS-5.4 Restrict Administrator Privileges to Dedicated Administrator Accounts CIS-6.1 Establish an Access Granting Process CIS-6.2 Establish an Access Revoking Process CIS-6.7 Centralize Access Control CIS-6.8 Define and Maintain Role-Based Access Control 5.10 Acceptable use of information and other associated assets 5.15 Access control 5.16 Identity management 5.18 Access rights 5.3 Segregation of duties 8.18 Use of privileged utility programs 8.2 Privileged access rights 8.3 Information access restriction 8.4 Access to source code ANSSI-HYG-05 Maintain an Exhaustive Inventory of Privileged Accounts ANSSI-HYG-06 Organise Joiner, Leaver and Role Change Procedures ANSSI-HYG-08 Identify Each Person by Name and Separate User and Administrator Roles ANSSI-HYG-09 Assign the Correct Rights on Sensitive Resources ANSSI-HYG-27 Prohibit Internet Access from Administration Workstations and Servers ANSSI-HYG-28 Use a Dedicated and Partitioned Network for Administration ANSSI-HYG-29 Limit Administration Rights on Workstations to Operational Need 5.15 Access control 5.18 Access rights 5.3 Segregation of duties 6.5 Responsibilities after termination or change of employment 8.2 Privileged access rights 8.3 Information access restriction 8.4 Access to source code 6.3.2 Mobile devices and teleworking 6.4.3 Termination and change of employment 6.6 Access control 6.6.1 Business requirements of access control 6.6.2 User access management 6.6.4 System and application access control SOC2-CC4.2 CC4.2 Evaluating and communicating control deficiencies (COSO principle 17) SOC2-CC6.1 CC6.1 Logical access security over protected information assets SOC2-CC6.2 CC6.2 Registering and authorising users before issuing credentials SOC2-CC6.3 CC6.3 Role-based access, least privilege and segregation of duties SOC2-CC7.4 CC7.4 Responding to security incidents SOC2-P5.1 P5.1 Data subject access NRC7354-2 Critical Digital Asset (CDA) Identification, Scope, and Boundary NRC7354-4 Security Controls Implementation per NRC RG 5.71 Appendix B/C RG5.71-C.3 Cyber Security Training RG5.71-C.5 Recovery and Restoration RG5.71-C.6 Configuration Management ASD37-18 Restrict administrative privileges (Essential) ASD37-20 Multi-factor authentication (Essential) ASD37-21 Disable local administrator accounts (Excellent) ASD37-37 Personnel management (Very Good) AWWA-1.1 Security Policy and Governance AWWA-1.3 Security Awareness and Training AWWA-2.1 User Access Management AWWA-3.2 Remote Access Security DA-1 Enterprise Data Architecture DIQ-2 Data Quality Management DSO-3 Data Access Management RMD-1 Reference Data Management ISO-15189-5.1 Legal entity ISO-15189-5.4 Structure and authority ISO-15189-6.2 Personnel ISO-15189-6.7 Service agreements ISO-19650-1-4 Information management concepts ISO-19650-1-7 Common Data Environment (CDE) concept ISO-19650-2-5.7 Information model delivery ISO-19650-3-5.3 Trigger events for information exchange SSAE18-CC6.2 CC6.2 - New User Registration and Authorization SSAE18-CC7.4 CC7.4 - Incident Response SSAE18-PI1.1 PI1.1 - Processing Integrity Definition SSAE18-SOC1-06 Transaction Processing Controls ISM-1508 Least privilege for privileged access ISM-1833 Minimum privileges for user accounts ISM-1852 Least privilege for unprivileged access IEC62304-5.2 Software Requirements Analysis IEC62304-5.3 Software Architectural Design IEC62304-7.2 Risk Control Measures ISO-22320-5.1 General process requirements ISO-22320-5.3 Incident management structure (command) ISO-22320-5.4 Roles and responsibilities ISO23894-1 Scope of AI Risk Management ISO23894-3 AI-Specific Terminology ISO23894-6.2 Scope, Context and Criteria 27004-3 Terms and definitions 27004-A.2 Patching and Vulnerability Measures 27004-B.1 Example measurement definitions 27011-1 Scope 27011-3 Terms and definitions 27011-8.1 User Endpoint Devices 27557-1 Scope 27557-3 Terms and definitions 27557-6.2 Scope, context, and criteria for privacy 29100-1 Scope 29100-3 Terms and definitions 29100-4.1 Actors and roles PR.AC-1 PR.AC-1: Identities and credentials are managed for authorized devices and users PR.AC-3 PR.AC-3: Remote access is managed PR.AC-4 PR.AC-4: Access permissions are managed, incorporating the principles of least privilege and separation of duties PR.AC-1 PR.AC-1: Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users and processes PR.AC-3 PR.AC-3: Remote access is managed PR.AC-4 PR.AC-4: Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties 3.1.1e Dual Authorization for Sensitive System Operations 3.1.2e Restrict Access to Organization-Owned, Provisioned, or Issued Information Resources 3.13.2e Introduce Unpredictability into System Operations NISTSP82-1 OT Security Program Governance, Policy, Roles, and Safety-Security Integration NISTSP82-4 OT Access Control, Identity, Authentication, and Remote Access NISTSP82-7 OT Incident Response, Forensics, Recovery, and Continuity ORANWG11-2 O-RAN Interface Security: E2, A1, O1, O2, Open Fronthaul ORANWG11-3 Cryptography, TLS, SSH, IPsec, and PKI Lifecycle Management ORANWG11-6 Security Test Specifications, Certification, and Conformance PICSGMP-2 Chapter 2: Personnel - Qualified Personnel, Key Responsibilities, Training PICSGMP-5 Chapter 5: Production Operations and Material Management PICSGMP-7 Chapter 7: Outsourced Activities and Supplier Management TRINIDAD-1 Scope, Definitions, Commission TRINIDAD-2 Lawful Processing and Consent TRINIDAD-3 Data Subject Rights Section 6(5) Definition of Foreign Public Official Section 8 Definition of Associated Person UKBRIBE-3 Due Diligence on Third Parties CE-AC.4 Privileged Account Approval and Tracking CE-AC.5 Separate Admin Accounts for Administrative Activities CE-AC.6 Periodic Review of Privileged Access 58.1 Scope 58.3 Definitions E8-ADMIN-ML1 Restrict Administrative Privileges (ML1) E8-ADMIN-ML3 Restrict Administrative Privileges (ML3) AL-DPA-1 Scope and Definitions AL-DPA-3 Lawful Basis for Processing MYHR-SEC-2 Access controls and user account management MYHR-SEC-7 Consumer access controls and consent AT-DSG-2 Section 2 - Scope and application AT-DSG-8 Section 22 - Functions and powers of the DPA MLE.1 Machine Learning Requirements Analysis MLE.3 Machine Learning Training FEDRAMP-CM-6 Configuration Settings FEDRAMP-CP-9 System Backup FDBR-702 Definitions (§501.702) FDBR-Scope-Defs Scope, Applicability Thresholds and Definitions (Fla. Stat. 501.701, 501.702, 501.703, 501.704) 60601-1.3 Terminology and definitions 60601-1.4.1 General requirements 62351-2 Glossary of terms 62351-8 Role-based access control (RBAC) ISO-20400-4.2 Principles of sustainable procurement ISO-20400-7.2 Integrating sustainability into specifications ISO-41001-4.1 Understanding the organization and its context ISO-41001-4.3 Determining the scope of the FM management system ISO-56002-4.3 Determining the scope of the innovation management system ISO-56002-8.3.4 Develop solutions ISO8000-DQM-02 Data Quality Dimensions ISO8000-MDG-03 Continuous Improvement ISO-17025-5.1 Legal entity ISO-17025-5.4 Personnel for the management system ISO-25012-5.2 Defining data quality measures ISO-25012-5.3 Planning and performing data quality evaluations 27014-1 Scope 27014-3 Terms and definitions ISO27043-04 Roles and responsibilities definition ISO27043-14 Privileged access management 27400-3 Terms and definitions 27400-6.1 Secure Device Design 29147-3 Terms and definitions 29147-9.2 Contact mechanisms and scope 30111-3 Terms and definitions 30111-5.1 Organizational policy ISO21434-04 Roles and responsibilities definition ISO21434-14 Privileged access management STANAG-1 STANAG 4774 Confidentiality Label Schema and XML Structure STANAG-2 STANAG 4778 Metadata Binding Mechanism and Cryptographic Binding NISTPF-3 Control-P - Privacy Controls, Data Management, and Disassociated Processing NISTPF-5 Protect-P Access Control (PR.AC-P) NISTSP115-1 Scope, Methodology, and Assessment Planning NISTSP115-8 Operational Considerations - Tools, Reporting Templates, ISMS Integration, Annex Material NISTSP123-3 Authentication, Access Control, and Account Management NISTSP123-8 Governance, Policies, and ISMS Integration NISTSP137-1 ISCM Strategy, Governance, and Volatility Assessment NISTSP137-6 Malware, Identity Access, and Network Boundary Monitoring NISTSP145-7 Cloud Procurement Standards Aligned to NIST SP 800-145 Definition NISTSP145-8 Governance, Reporting, and Stakeholder Education on Cloud Definition NISTSP146-1 Cloud Adoption Strategy, Workload Suitability, and Decision Framework NISTSP146-6 Cloud Security and Privacy Recommendations NISTSP61-2 Computer Security Incident Response Team (CSIRT) Structure and Staffing NISTSP61-5 Containment, Eradication, and Recovery NISTSP63R4-1 Digital Identity Risk Management and IAL/AAL/FAL Assurance Level Selection NISTSP63R4-3 Authentication: Authenticator Types, MFA, Phishing-Resistance, and Syncable Authenticators NISTSP92-1 Log Management Programme, Policy, Roles, and Operational Runbooks NISTSP92-4 Log Management: Time Synchronisation, Parsing, Storage, Integrity, Access Control NDPA-2 Consumer Rights - Access, Correct, Delete, Portability, Appeal NDPA-5 Privacy Notice, Data Minimisation, and Purpose Limitation OWASPSAMM-1 Governance: Strategy, Policy, Compliance, Education, Champions OWASPSAMM-2 Design: Threat Assessment, Security Requirements, Security Architecture OSSFSC-1 Branch Protection, Code Review, and Repository Governance OSSFSC-3 Build, CI/CD Security, Workflow Permissions, Dangerous Patterns PTESPHASE-1 Pre-Engagement Interactions and Scoping PTESPHASE-2 Intelligence Gathering (OSINT) PICERL-P2 Risk Assessment PICERL-P3 CSIRT Formation SHAREASSESS-1 Information Governance and Risk SHAREASSESS-2 Access Control, Identity, Authentication SUPCHAIN-1 Build Integrity - Source, Build, Provenance SUPCHAIN-2 Source Integrity - Branch Protection, Code Review, Two-Person Rule SAM-1 Customer Information Confidentiality (Section 48) SAM-6 Legal Authorization Requirements C1 Organizational Boundary C3 Scope 1 and 2 Coverage IM8-RES.2 Disaster Recovery IM8-SEC.2 Access Control ISMSP-AC-01 Access Control Policy ISMSP-SYS-04 Vulnerability Management TANZANIA-1 Scope, Registration, Lawful Basis TANZANIA-4 Security and Cross-Border UKGAMBLE-1 Scope and Applicability to Licensees UKGAMBLE-4 Resilience and Incident Response UK-TSA-NET-01 Security Architecture UK-TSA-NET-02 Access Control and Authentication US-SEC-DA-SC-01 Howey Test Application US-SEC-DA-SC-02 Registration Requirements CFR211-A-3 Section 211.3 - Definitions 4.4.1 Resources, Roles, Responsibility, and Authority AUCDR-IS-1 Limit risk of unauthorised access to the CDR data environment AESCSF-IAM-2 Access control AZ-DPA-2 Article 2 - Basic Concepts BSI-02 Access enforcement and least privilege BMA-16 Access Management and Segregation of Duties COBIT-BAI02 Managed requirements definition CAT-IRP-4 Organizational characteristics FFIEC-05 Roles and responsibilities definition FTC-Safeguards-Scope-Defs Scope, Definitions and Financial Institution Applicability (16 CFR 314.1, 314.2) Sapin2-Pillar1-Code-of-Conduct Pillar 1 - Anti-Corruption Code of Conduct ICP-1 Objectives, Powers and Responsibilities of the Supervisor IATA-IOSA-Section1-ORG-Organization-ManagementSystem-SMS IATA IOSA Section 1 - ORG Organization and Management System + Safety Management System (SMS) + Safety Policy + Hazard ID + Quality ISO-14064-1-5.1 Organizational boundaries ISO-26262-3-5 Item definition ISO27799-01 ePHI access controls and authorization ISO28001-PI-01 Personnel Security Screening ISO27003-4.3 Determining the scope of the information security management system 27007-5.2 Audit Programme Objectives 27050-1.4 Terms and definitions 29115-3 Terms and definitions 29134-3 Terms and definitions BIPA-SEC5-1 Biometric Identifier Definition Art.21.2.i Human resources security, access control policies and asset management NISTSP144-1 Cloud Governance, Risk Assessment, and Provider Trust Evaluation NISTSP66-6 Technical Safeguards: Access Control, Audit Controls, Integrity, Person Authentication NISTSP88-1 Media Sanitization Policy, Roles, and Decision Framework OSFIB13-1 Governance, Risk Management, and Three Lines of Defense OMANCS-3 Identity and Access Management, Authentication, Privileged Access OPENBANK-2 Strong Customer Authentication (SCA), Consent Lifecycle, and Customer UX PCI-P2PE-05 Roles and responsibilities definition PCI-PIN-05 Roles and responsibilities definition PCI-SSF-05 Roles and responsibilities definition PSDTWO-1 Strong Customer Authentication (SCA) Core Requirements PHILCC-1 Computer Crime Offences (Illegal Access, Interference, Misuse of Devices) RCEPEC-1 Online Personal Information Protection (12.13) RIDTPPA-1 Scope, Applicability, Definitions CISABD-1 Take Ownership of Customer Security Outcomes SOCI-CIRMP-SUPPLY CIRMP hazard vector: Supply chain SIGSTORE-2 Transparency Log (Rekor) and Verification SCA-S2 Interpretation and Definitions PIPA-Data-Subject-Rights-Access-Correction-Erasure-Portability-Automated-Decisions-Articles-35-37-2 Korea PIPA Data Subject Rights + Access + Correction + Erasure + Portability + Article 35-37 SWE-2 Relationship to GDPR FADP-5 Definitions (Article 5) TSAPIPE-2 OT/IT Network Segmentation and Access Control UKGDPRREG-1 Subject Matter, Scope, Principles (Articles 1-11) OB-OPS.2 Performance Standards ACE-CR-4 Cargo Release Authorization 15 U.S.C. § 78dd-2(h) Definition of Domestic Concern UGA-10 Sensitive Personal Data Prohibition WCAGREC-3 Principle 3: Understandable SO2.2 Digital health architecture blueprint Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in PR - Protect NIST-CSF-PR.AA-01 Identities and credentials for authorized users, services, and hardware are managed by the organization NIST-CSF-PR.AA-02 Identities are proofed and bound to credentials based on the context of interactions NIST-CSF-PR.AA-03 Users, services, and hardware are authenticated NIST-CSF-PR.AA-04 Identity assertions are protected, conveyed, and verified NIST-CSF-PR.AA-06 Physical access to assets is managed, monitored, and enforced commensurate with risk NIST-CSF-PR.AT-01 Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind NIST-CSF-PR.AT-02 Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind NIST-CSF-PR.DS-01 The confidentiality, integrity, and availability of data-at-rest are protected You are reading one control. How much of NIST Cybersecurity Framework 2.0 have you already done? NIST Cybersecurity Framework 2.0 NIST-CSF-PR.AA-05 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of NIST Cybersecurity Framework 2.0 your existing evidence covers. Hold ISO 27001:2022 and 73 of 106 NIST Cybersecurity Framework 2.0 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 174 were rejected on the ISO 27001:2022 pair alone.
Query this from an agent The graph holds this control, the 509 it maps to, and the evidence behind each claim, over MCP and REST.