UK Telecommunications (Security) Act 2021 UK-TSA-NET-02: Access Control and Authentication

What else in your programme already covers this

This control maps to 204 controls across 68 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

NIST SP 800-53 Rev 5 · 9 controls

NIST800-AC-2 Account management
NIST800-AC-20 Use of external systems
NIST800-AC-6 Least privilege
NIST800-AC-7 Unsuccessful logon attempts
NIST800-AT-3 Role-based training
NIST800-IA-4 Identifier management
NIST800-IA-7 Cryptographic module authentication
NIST800-IA-8 Identification and authentication of non-organizational users
NIST800-PE-2 Physical access authorizations

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association) · 4 controls

AWWA-1.3 Security Awareness and Training
AWWA-2.1 User Access Management
AWWA-2.2 Authentication Mechanisms
AWWA-2.4 Physical Access Controls

BSI IT-Grundschutz · 4 controls

BSI-02 Access enforcement and least privilege
BSI-03 Multi-factor authentication requirements
BSI-04 Remote access controls
BSI-05 Wireless access restrictions

CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0 · 4 controls

CPG-1.A Changing Default Passwords
CPG-1.C Unique Credentials
CPG-4.C Basic Cybersecurity Training
CPG-8.A Network Segmentation

ISO 13485 · 4 controls

ISO13485-01 ePHI access controls and authorization
ISO13485-08 Information access management
ISO13485-12 Unique user identification and authentication
ISO13485-17 Facility access controls

ISO 27043 · 4 controls

ISO27043-11 Access control policy and enforcement
ISO27043-13 Authentication and password management
ISO27043-14 Privileged access management
ISO27043-15 Access review and recertification

ISO 27799 · 4 controls

ISO27799-01 ePHI access controls and authorization
ISO27799-08 Information access management
ISO27799-12 Unique user identification and authentication
ISO27799-17 Facility access controls

ISO/SAE 21434 · 4 controls

ISO21434-12 User access management and provisioning
ISO21434-13 Authentication and password management
ISO21434-14 Privileged access management
ISO21434-15 Access review and recertification

3GPP 5G Security Architecture (TS 33.501) · 3 controls

TS33.501-13.1 NF Registration and Discovery Security
TS33.501-13.4 OAuth 2.0 Authorization Framework
TS33.501-6.1 Authentication Framework

API 1164 · 3 controls

API1164-06 Access Control
API1164-07 Remote Access
API1164-09 Patch and Vulnerability Management

ASD Strategies to Mitigate Cyber Security Incidents · 3 controls

ASD37-18 Restrict administrative privileges (Essential)
ASD37-20 Multi-factor authentication (Essential)
ASD37-23 Protect authentication credentials (Excellent)

FFIEC Cybersecurity Assessment Tool (CAT) · 3 controls

CAT-D3-1 Preventative controls
CAT-D4-3 Third-party access controls
CAT-IRP-4 Organizational characteristics

IEC 62443 · 3 controls

IEC62443-07 Personnel risk assessment
IEC62443-08 Electronic access perimeter management
IEC62443-10 Revocation of access procedures

ISO 22739:2024 - Blockchain and Distributed Ledger Technologies Vocabulary · 3 controls

ISO-22739-3.3.1 Permissioned DLT system
ISO-22739-3.4.1 Token
ISO-22739-3.4.2 Tokenization

ISO 27019 · 3 controls

ISO27019-07 Personnel risk assessment
ISO27019-08 Electronic access perimeter management
ISO27019-10 Revocation of access procedures

ISO/IEC 29115:2023 - Entity Authentication Assurance Framework · 3 controls

29115-11 Mapping other authentication schemes
29115-12.1 Exchanging authentication results
29115-12.2 Controls for mitigating threats

NIST Cybersecurity Framework 2.0 · 3 controls

NIST-CSF-PR.AA-01 Identities and credentials for authorized users, services, and hardware are managed by the organization
NIST-CSF-PR.AA-02 Identities are proofed and bound to credentials based on the context of interactions
NIST-CSF-PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties

NIST SP 1800-32 · 3 controls

NIST1800-32-07 Personnel risk assessment
NIST1800-32-08 Electronic access perimeter management
NIST1800-32-09 Interactive remote access security

South Korea ISMS-P · 3 controls

ISMSP-AC-01 Access Control Policy
ISMSP-AC-03 Authentication Mechanisms
ISMSP-AC-04 Network Access Control

UK Open Banking Standard · 3 controls

OB-CX.3 Strong Customer Authentication
OB-DIR.1 Open Banking Directory
OB-SEC.4 Certificate Management

DAMA-DMBOK2 - Data Management Body of Knowledge (2nd Edition) · 2 controls

DSO-2 Data Security
DSO-3 Data Access Management

ISO 27017 · 2 controls

ISO27017-07 Multi-factor authentication for cloud
ISO27017-08 Privileged access in cloud environments

ISO 27018 · 2 controls

ISO27018-07 Multi-factor authentication for cloud
ISO27018-08 Privileged access in cloud environments

ISO/IEC 27010:2015 · 2 controls

27010-9.1 Access Control to Shared Information
27010-9.2 Authentication of Sources

ISO/IEC 27011:2024 · 2 controls

27011-5.3 Segregation of duties
27011-8.1 User Endpoint Devices

ITU-T X.805 - Security Architecture for End-to-End Communications · 2 controls

X805-Dim1-Access-Control-RBAC-Authorization-Resources-Network-Elements-Services-Applications ITU-T X.805 Security Dimension 1 - Access Control + Role-Based Access Control (RBAC) + Authorization + Resources + Network Elements + Services + Applications + Access Limitations + Authorized Personnel + Discretionary + Mandatory Access Control
X805-Dim2-Authentication-Identity-Verification-Claimed-Identities-Entities-Communication ITU-T X.805 Security Dimension 2 - Authentication + Identity Verification + Claimed Identity + Entity Authentication + Data Origin Authentication + Mutual Authentication + Multi-Factor + Cryptographic Authentication

Illinois Biometric Information Privacy Act (BIPA) · 2 controls

BIPA-SEC5-1 Biometric Identifier Definition
BIPA-SEC5-2 Biometric Information Definition

MARS-E - Minimum Acceptable Risk Standards for Exchanges · 2 controls

MARSE-SC-02 Federal Tax Information Protection
MARSE-SC-03 Identity Verification

NIST SP 800-190 · 2 controls

NIST190-07 Multi-factor authentication for cloud
NIST190-08 Privileged access in cloud environments

SOC 2 · 2 controls

SOC2-CC6.2 Prior to granting access, registration and authorization processes are established
SOC2-CC6.3 Role-based access and least privilege are enforced

SSAE 18 - Attestation Standards (SOC Reporting) · 2 controls

SSAE18-CC6.2 CC6.2 - New User Registration and Authorization
SSAE18-SOC1-06 Transaction Processing Controls

Samoa Telecommunications Act (2005) - Privacy & Data Protection · 2 controls

SAM-1 Customer Information Confidentiality (Section 48)
SAM-6 Legal Authorization Requirements

AML/CTF Act 2006 (Australia) · 1 control

AMLCTF-35 Identity Verification Standard

APPI · 1 control

APPI-A26 Report of Leakage to the Commission and Notification to the Person

Annex 11 to EU GMP - Computerised Systems · 1 control

Clause 12 Security

Armenia Law on Protection of Personal Data (2015) · 1 control

AM-DPA-10 Retention and Deletion

Authorised Economic Operator (AEO) Programmes - Global Standards · 1 control

P2-S3 Authorization

Bahrain PDPL · 1 control

BH-PDPL-15 Access control for personal data

Bank Secrecy Act / Anti-Money Laundering (BSA/AML) · 1 control

BSA-CIP-2 Identity Verification

Canada ITSG-33 - IT Security Risk Management · 1 control

CA-ITSG33-SC-01 Security Control Catalogue

ICAO Annex 17 - Aviation Security (AVSEC) · 1 control

ICAO-ANX17-Chap2-ThreatAssessment-RiskManagement-Cyber-GASeP ICAO Annex 17 Chapter 2 - Threat Assessment + Risk Management + Cyber Threats to Critical Aviation Systems (Amendment 17/18)

IEC 62351 - Power Systems Communication Security · 1 control

62351-8 Role-based access control (RBAC)

ISO 15189:2022 - Medical Laboratories Requirements for Quality and Competence · 1 control

ISO-15189-6.2 Personnel

ISO 19011 · 1 control

6.5 Preparing and Distributing Audit Report

ISO 19650 - Organisation and Digitisation of Information about Buildings and Civil Engineering Works (BIM) · 1 control

ISO-19650-2-5.7 Information model delivery

ISO 20000-1 · 1 control

ISO20000-15 Access management for services

ISO 28001:2007 Supply Chain Security Management · 1 control

ISO28001-PS-01 Facility Security

ISO/IEC 23837 - Security Requirements for Quantum Key Distribution · 1 control

23837-1.7.3 Authentication and classical post-processing

ISO/IEC 27400:2022 · 1 control

27400-6.1 Secure Device Design

ITIL 4 · 1 control

ITIL4-15 Access management for services

NIST SP 800-124 Revision 2 - Guidelines for Managing the Security of Mobile Devices · 1 control

MD124-CTL-01 Device Authentication and Lock

NRC 10 CFR 73.54 - Nuclear Facility Cybersecurity · 1 control

RG5.71-C.3 Cyber Security Training

SOC for Cybersecurity - Cybersecurity Risk Management Examination · 1 control

SOC-CY-S1 Logical and Physical Access Controls

Saudi Arabia PDPL · 1 control

SA-PDPL-15 Access control for personal data

Security of Critical Infrastructure Act 2018 (SOCI) · 1 control

SOCI-CIRMP-SUPPLY CIRMP hazard vector: Supply chain

Singapore Government Instruction Manual on ICT&SS Management (IM8) · 1 control

IM8-SEC.2 Access Control

Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023) · 1 control

CH-FADP-15 Cooperation with the FDPIC

TISAX - Trusted Information Security Assessment Exchange · 1 control

TISAX-TECH-01 Access Control and Identity Management

UK Security and Emergency Measures Direction (SEMD) - Water Industry · 1 control

SEMD-PS-2 Site Security Measures

US Automated Commercial Environment (ACE) - CBP Trade Data Requirements · 1 control

ACE-CR-4 Cargo Release Authorization

US Consumer Product Safety Commission (CPSC) - Connected Product Safety · 1 control

CPSC-CS.2 Authentication and Access Controls

US ITAR and EAR - Export Control and Data Security · 1 control

US-ITAR-EAR-DS-03 Access Controls

US Maritime Transportation Security Act (MTSA) and USCG Cybersecurity Requirements · 1 control

CYB-2 Account Security Measures

Uganda Data Protection and Privacy Act (2019) · 1 control

UGA-10 Sensitive Personal Data Prohibition

Uruguay DPL · 1 control

URUGUAY-3 Sensitive Data, Health Data, Children

Virginia CDPA · 1 control

VIRGINIAVCDPA-3 Sensitive Data Consent and Children

W3C Verifiable Credentials (VC) Data Model 2.0 · 1 control

VP-2 Holder Binding

WCAG 2.2 · 1 control

WCAGREC-3 Principle 3: Understandable

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.