Establish and Maintain an Inventory of Authentication and Authorization Systems

frameworkCIS Controls v8.1 section6. Access Control Management csf 2.0PR.AA-01 PR.AA-05 topicsAccess Control frameworks0 11 1

Official text · not licensableSafeguard title © CIS (CC BY-NC-ND 4.0). See CIS Controls v8.1 for details.

gap from CIS v8.1 → gap to CIS v8.1 →

Wrong or missing mapping? Report it

Equivalents of CIS 6.6 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	PR.AA-01 PR.AA-05	Identities and credentials for authorized users, services, and hardware are managed by the organization; Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties	Editorial	Same topic: Access Control (editorial pick)
ISO 27001	A.5.15 A.5.16 A.5.18 A.8.3	Access control; Identity management…	Editorial	Same topic: Access Control (editorial pick) 9 loosely related (not mappings) A.8.2 Privileged access rights Loosely related Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping A.8.5 Secure authentication Loosely related Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping A.5.1 Policies for information security Loosely related Only shares CSF PR.AA-05: related, not a mapping A.5.3 Segregation of duties Loosely related Only shares CSF PR.AA-05: related, not a mapping A.5.14 Information transfer Loosely related Only shares CSF PR.AA-05: related, not a mapping A.5.17 Authentication information Loosely related Only shares CSF PR.AA-05: related, not a mapping A.6.7 Remote working Loosely related Only shares CSF PR.AA-05: related, not a mapping A.8.4 Access to source code Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 1 more in the downloads
SOC 2	CC6.1 CC6.2 CC6.3	Logical access security over information assets; User registration, authorization and removal…	Editorial	Same topic: Access Control (editorial pick) 2 loosely related (not mappings) CC6.6 Protection against threats from outside system boundaries Loosely related Only shares CSF PR.AA-05: related, not a mapping CC6.7 Restricting transmission, movement and removal of information Loosely related Only shares CSF PR.AA-05: related, not a mapping
PCI DSS	7.2.1 7.2.2 7.2.4 8.2.1	Access control model defined; Access assigned by job function and least privilege…	Editorial	Same topic: Access Control (editorial pick) 14 loosely related (not mappings) 3.6.1 Procedures protect keys that secure stored account data Loosely related Only shares CSF PR.AA-01: related, not a mapping 3.6.1.1 Service providers document their cryptographic architecture Loosely related Only shares CSF PR.AA-01: related, not a mapping 3.6.1.2 Secret and private keys stored in approved forms Loosely related Only shares CSF PR.AA-01: related, not a mapping 3.6.1.3 Cleartext key components accessible to fewest custodians Loosely related Only shares CSF PR.AA-01: related, not a mapping 3.6.1.4 Keys stored in the fewest possible locations Loosely related Only shares CSF PR.AA-01: related, not a mapping 7.1.1 Access restriction policies documented and kept current Loosely related Only shares CSF PR.AA-05: related, not a mapping 7.2.5.1 System and application account access periodically reviewed Loosely related Only shares CSF PR.AA-05: related, not a mapping 8.1.1 Identification and authentication policies documented Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 6 more in the downloads
CMMC	AC.L2-3.1.1 AC.L2-3.1.2	Authorized Access Control; Transaction & Function Control	Editorial	Same topic: Access Control (editorial pick) 29 loosely related (not mappings) SC.L2-3.13.3 Role Separation Loosely related Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping AC.L2-3.1.4 Separation of Duties Loosely related Only shares CSF PR.AA-05: related, not a mapping AC.L2-3.1.5 Least Privilege Loosely related Only shares CSF PR.AA-05: related, not a mapping AC.L2-3.1.6 Non-Privileged Account Use Loosely related Only shares CSF PR.AA-05: related, not a mapping AC.L2-3.1.7 Privileged Functions Loosely related Only shares CSF PR.AA-05: related, not a mapping AC.L2-3.1.12 Control Remote Access Loosely related Only shares CSF PR.AA-05: related, not a mapping AC.L2-3.1.13 Remote Access Confidentiality Loosely related Only shares CSF PR.AA-05: related, not a mapping AC.L2-3.1.14 Remote Access Routing Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 21 more in the downloads
800-53	AC-2 AC-3	Account Management; Access Enforcement	Editorial	Same topic: Access Control (editorial pick) 23 loosely related (not mappings) AC-2(7) Privileged User Accounts Loosely related Only shares CSF PR.AA-05: related, not a mapping AC-5 Separation of Duties Loosely related Only shares CSF PR.AA-05: related, not a mapping AC-6 Least Privilege Loosely related Only shares CSF PR.AA-05: related, not a mapping AC-6(5) Privileged Accounts Loosely related Only shares CSF PR.AA-05: related, not a mapping AC-10 Concurrent Session Control Loosely related Only shares CSF PR.AA-05: related, not a mapping AC-14 Permitted Actions Without Identification or Authentication Loosely related Only shares CSF PR.AA-01: related, not a mapping AC-16 Security and Privacy Attributes Loosely related Only shares CSF PR.AA-05: related, not a mapping AC-17 Remote Access Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 15 more in the downloads
HIPAA	§164.308(a)(4)§164.312(a)§164.312(a)(2)(i)§164.312(d)	Information Access Management; Access Control…	Editorial	Same topic: Access Control (editorial pick) 11 loosely related (not mappings) §164.308(a)(3) Workforce Security Loosely related Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping §164.308(a)(3)(ii)(A) Authorization and/or Supervision Loosely related Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping §164.308(a)(3)(ii)(B) Workforce Clearance Procedure Loosely related Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping §164.308(a)(4)(ii)(B) Access Authorization Loosely related Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping §164.308(a)(4)(ii)(C) Access Establishment and Modification Loosely related Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping §164.312(a)(2)(ii) Emergency Access Procedure Loosely related Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping §164.316(b)(2)(ii) Availability Loosely related Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping §164.316(b)(2)(iii) Updates Loosely related Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping …and 3 more in the downloads
GDPR	Art.25(2)Art.32(1)(b)	Data protection by design and by default; Security of processing	Editorial	Same topic: Access Control (editorial pick)
NIS2	11.1 11.2 11.5	Access control policy; Management of access rights…	Editorial	Same topic: Access Control (editorial pick) 2 loosely related (not mappings) 11.4 Administration systems Loosely related Only shares CSF PR.AA-05: related, not a mapping 11.6 Authentication Loosely related Only shares CSF PR.AA-05: related, not a mapping
Essential Eight	ISM-0445 ISM-1175 ISM-1380 ISM-1387	Privileged human users are assigned a dedicated privileged user account to be used…; Privileged user accounts (excluding those explicitly authorised to access online……	Loosely related	No mapping. Only shares CSF PR.AA-05: related, not a mapping +16 more loosely related (not mappings) ISM-1507 Requests for privileged access to systems and their resources are validated when first… Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1508 Privileged access to systems and their resources is limited to only what is required… Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1509 Privileged access events are centrally logged Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1647 Privileged access to systems and their resources are disabled after 12 months unless… Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 12 more in the downloads
DORA	Art.9(4)(c)	Protection and prevention	Editorial	Same topic: Access Control (editorial pick)
CPS 234	—	No requirement	No mapping in our data	No mapping in our data (CPS 234 is principles-based and its links are editorial).
Cyber Essentials	CE 4	User Access Control	Editorial	Same topic: Access Control (editorial pick) 1 loosely related (not mappings) CE 2 Secure Configuration Loosely related Only shares CSF PR.AA-05: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.