NIST SP 800-66 Rev 2 164.308(a)(3)(ii)(A): Authorization and Supervision (Addressable)

What else in your programme already covers this

This control maps to 59 controls across 25 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ISO 27001:2022 · 5 controls

5.18 Access rights
5.2 Information security roles and responsibilities
5.4 Management responsibilities
6.1 Screening
8.2 Privileged access rights

ISO 27002:2022 · 5 controls

5.18 Access rights
5.2 Information security roles and responsibilities
5.4 Management responsibilities
6.1 Screening
6.2 Terms and conditions of employment

NIST SP 800-53 Rev 5 · 5 controls

NIST800-AC-2 AC-2 Account Management
NIST800-CA-6 CA-6 Authorization
NIST800-PM-10 PM-10 Authorization Process
NIST800-PS-1 PS-1 Policy and Procedures
NIST800-PS-7 PS-7 External Personnel Security

PCI DSS 4.0 · 5 controls

7.2.3 7.2.3 Privileges approved by authorized personnel
8.2.4 8.2.4 User ID lifecycle changes authorized
9.3.2 9.3.2 Visitor access procedures for the CDE
7.2.4 7.2.4 User accounts and privileges reviewed every six months
7.3.1 7.3.1 Need-to-know access control system covers all components

Azure Security Benchmark · 4 controls

ASBv3-IM-2 Protect identity and authentication systems
ASBv3-PA-7 Follow just enough administration (least privilege) principle
PA-1 Separate and limit highly privileged/administrative users
PA-2 Avoid standing access for user accounts and permissions

AWS Well-Architected Security Pillar · 3 controls

SEC01-BP02 Secure account root user and properties
SEC03-BP01 Define access requirements
SEC06-BP03 Reduce manual management and interactive access

C5 (Germany) · 3 controls

C5-HR-02 Employment terms and conditions
C5-IDM-02 Granting and change of user accounts and access rights
C5-IDM-06 Privileged access rights

SOC 2 · 3 controls

SOC2-CC1.5 CC1.5 Accountability for internal control responsibilities (COSO principle 5)
SOC2-CC5.1 CC5.1 Selecting control activities that mitigate risk (COSO principle 10)
SOC2-CC6.2 CC6.2 Registering and authorising users before issuing credentials

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 2 controls

ANSSI-HYG-05 Maintain an Exhaustive Inventory of Privileged Accounts
ANSSI-HYG-09 Assign the Correct Rights on Sensitive Resources

Australia My Health Records Act 2012 · 2 controls

MYHR-SEC-2 Access controls and user account management
MYHR-SEC-3 Audit logging and access monitoring

CMMC 2.0 · 2 controls

AC.L2-3.1.1 Authorized Access Control
AC.L2-3.1.5 Least Privilege

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 2 controls

CCM-HRS-09 Personnel Roles and Responsibilities
CCM-IAM-06 User Access Provisioning

FedRAMP High · 2 controls

AC-2 Account Management
AC-6 Least Privilege

FedRAMP Moderate · 2 controls

AC-2 Account Management
AC-6 Least Privilege

NIST SP 800-161 Rev 1 · 2 controls

161R1-MA-5 Maintenance Personnel
161R1-PS-6 Access Agreements

NIST SP 800-171 Rev 3 · 2 controls

03.01.01 Account Management
03.01.05 Least Privilege

UK Cyber Essentials · 2 controls

CE-AC.1 User Account Approval Process
CE-AC.5 Separate Admin Accounts for Administrative Activities

ACSC Essential Eight · 1 control

E8-ADMIN-ML1 Restrict Administrative Privileges (ML1)

APEC Cross-Border Privacy Rules (CBPR) System · 1 control

CBPR-PR-29 Employee security awareness

APPI · 1 control

APPI-A24 Supervision of Employees

ASD Strategies to Mitigate Cyber Security Incidents · 1 control

ASD37-18 Restrict administrative privileges (Essential)

CIS Controls v8 · 1 control

CIS-6.1 Establish an Access Granting Process

ISO 27701:2019 · 1 control

6.4.2 During employment

NIST Cybersecurity Framework 2.0 · 1 control

NIST-CSF-PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties

NIST SP 800-172 · 1 control

3.1.1e Dual Authorization for Sensitive System Operations

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.