Authorized Access Control

frameworkCMMC Level 2 sectionAC Access Control csf 2.0DE.CM-01 DE.CM-03 PR.AA-01 PR.AA-05 PR.DS-10 topicsAccess Control, Zero Trust frameworks7 4 0

Official textLimit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).NIST SP 800-171 Rev 2 requirement, the basis of the CMMC Level 2 practice (public domain)

gap from CMMC → gap to CMMC →

Wrong or missing mapping? Report it

Equivalents of AC.L2-3.1.1 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	PR.AA-01 PR.AA-03 PR.AA-04 PR.AA-05 PR.IR-01	Identities and credentials for authorized users, services, and hardware are managed by the organization; Users, services, and hardware are authenticated…	Crosswalk	Same topic: Access Control, Zero Trust 3 loosely related (not mappings) DE.CM-01 Networks and network services are monitored to find potentially adverse events Loosely related Only shares CSF DE.CM-01: related, not a mapping DE.CM-03 Personnel activity and technology usage are monitored to find potentially adverse events Loosely related Only shares CSF DE.CM-03: related, not a mapping PR.DS-10 The confidentiality, integrity, and availability of data-in-use are protected Loosely related Only shares CSF PR.DS-10: related, not a mapping
ISO 27001	A.5.15 A.5.16 A.5.18 A.8.3 A.8.5 A.8.22	Access control; Identity management…	Crosswalk	Same topic: Access Control, Zero Trust 22 loosely related (not mappings) A.8.2 Privileged access rights Loosely related Only shares CSF PR.AA-01, PR.AA-05, PR.DS-10: related, not a mapping A.5.3 Segregation of duties Loosely related Only shares CSF PR.AA-05, PR.DS-10: related, not a mapping A.5.14 Information transfer Loosely related Only shares CSF PR.AA-05, PR.DS-10: related, not a mapping A.8.4 Access to source code Loosely related Only shares CSF PR.AA-05, PR.DS-10: related, not a mapping A.8.16 Monitoring activities Loosely related Only shares CSF DE.CM-01, DE.CM-03: related, not a mapping A.5.1 Policies for information security Loosely related Only shares CSF PR.AA-05: related, not a mapping A.5.10 Acceptable use of information and other associated assets Loosely related Only shares CSF PR.DS-10: related, not a mapping A.5.13 Labelling of information Loosely related Only shares CSF PR.DS-10: related, not a mapping …and 14 more in the downloads
CIS v8.1	CIS 3.3 CIS 5.1 CIS 5.6 CIS 6.7 CIS 6.8 CIS 12.2 CIS 5.2 CIS 5.3 CIS 5.5 CIS 6.1 CIS 6.2 CIS 6.6 CIS 12.5 CIS 12.7 CIS 13.5	Configure Data Access Control Lists; Establish and Maintain an Inventory of Accounts…	Crosswalk	Same topic: Access Control, Zero Trust 21 loosely related (not mappings) CIS 10.7 Use Behavior-Based Anti-Malware Software Loosely related Only shares CSF DE.CM-03: related, not a mapping CIS 13.1 Centralize Security Event Alerting Loosely related Only shares CSF DE.CM-01: related, not a mapping CIS 13.6 Collect Network Traffic Flow Logs Loosely related Only shares CSF DE.CM-01, DE.CM-03: related, not a mapping CIS 3.1 Establish and Maintain a Data Management Process Loosely related Only shares CSF PR.DS-10: related, not a mapping CIS 3.4 Enforce Data Retention Loosely related Only shares CSF PR.DS-10: related, not a mapping CIS 3.5 Securely Dispose of Data Loosely related Only shares CSF PR.DS-10: related, not a mapping CIS 3.12 Segment Data Processing and Storage Based on Sensitivity Loosely related Only shares CSF PR.DS-10: related, not a mapping CIS 3.13 Deploy a Data Loss Prevention Solution Loosely related Only shares CSF PR.DS-10: related, not a mapping …and 13 more in the downloads
SOC 2	CC6.1 CC6.2 CC6.3 CC6.6	Logical access security over information assets; User registration, authorization and removal…	Editorial	Same topic: Access Control, Zero Trust (editorial pick) 4 loosely related (not mappings) CC6.7 Restricting transmission, movement and removal of information Loosely related Only shares CSF PR.AA-05, PR.DS-10: related, not a mapping CC7.2 Monitoring system components for anomalies Loosely related Only shares CSF DE.CM-01, DE.CM-03: related, not a mapping C1.2 Disposing of confidential information Loosely related Only shares CSF PR.DS-10: related, not a mapping CC6.5 Protection of data when assets are disposed of Loosely related Only shares CSF PR.DS-10: related, not a mapping
PCI DSS	7.2.1 7.2.2 7.2.4 8.2.1 8.3.1	Access control model defined; Access assigned by job function and least privilege…	Crosswalk	Same topic: Access Control, Zero Trust 26 loosely related (not mappings) 10.2.1 Audit logs enabled and active Loosely related Only shares CSF DE.CM-01, DE.CM-03: related, not a mapping 10.4.1 Security event and critical logs reviewed daily Loosely related Only shares CSF DE.CM-01, DE.CM-03: related, not a mapping 1.2.4 Accurate account-data flow diagram maintained Loosely related Only shares CSF DE.CM-01: related, not a mapping 3.2.1 Account data storage minimised, with retention and disposal Loosely related Only shares CSF PR.DS-10: related, not a mapping 3.4.1 PAN masked when displayed Loosely related Only shares CSF PR.DS-10: related, not a mapping 3.6.1 Procedures protect keys that secure stored account data Loosely related Only shares CSF PR.AA-01: related, not a mapping 3.6.1.1 Service providers document their cryptographic architecture Loosely related Only shares CSF PR.AA-01: related, not a mapping 3.6.1.2 Secret and private keys stored in approved forms Loosely related Only shares CSF PR.AA-01: related, not a mapping …and 18 more in the downloads
800-53	AC-2 AC-3 AC-4 AC-6 IA-2 AC-17	Account Management; Access Enforcement…	Crosswalk	Same topic: Access Control, Zero Trust NIST SP 800-171r2 Appendix D 51 loosely related (not mappings) AU-12 Audit Record Generation Loosely related Only shares CSF DE.CM-01, DE.CM-03: related, not a mapping AU-13 Monitoring for Information Disclosure Loosely related Only shares CSF DE.CM-03, PR.DS-10: related, not a mapping CA-7 Continuous Monitoring Loosely related Only shares CSF DE.CM-01, DE.CM-03: related, not a mapping SC-7 Boundary Protection Loosely related Only shares CSF DE.CM-01, PR.DS-10: related, not a mapping SI-4 System Monitoring Loosely related Only shares CSF DE.CM-01, PR.DS-10: related, not a mapping AC-5 Separation of Duties Loosely related Only shares CSF PR.AA-05: related, not a mapping AC-10 Concurrent Session Control Loosely related Only shares CSF PR.AA-05: related, not a mapping AC-14 Permitted Actions Without Identification or Authentication Loosely related Only shares CSF PR.AA-01: related, not a mapping …and 43 more in the downloads
HIPAA	§164.308(a)(4)§164.312(a)§164.312(a)(2)(i)§164.312(d)	Information Access Management; Access Control…	Crosswalk	Same topic: Access Control 26 loosely related (not mappings) §164.308(a)(3) Workforce Security Loosely related Only shares CSF DE.CM-01, DE.CM-03, PR.AA-01, PR.AA-05…: related, not a mapping §164.308(a)(3)(ii)(A) Authorization and/or Supervision Loosely related Only shares CSF DE.CM-01, DE.CM-03, PR.AA-01, PR.AA-05…: related, not a mapping §164.308(a)(3)(ii)(B) Workforce Clearance Procedure Loosely related Only shares CSF DE.CM-01, DE.CM-03, PR.AA-01, PR.AA-05…: related, not a mapping §164.308(a)(4)(ii)(B) Access Authorization Loosely related Only shares CSF DE.CM-01, DE.CM-03, PR.AA-01, PR.AA-05…: related, not a mapping §164.308(a)(4)(ii)(C) Access Establishment and Modification Loosely related Only shares CSF DE.CM-01, DE.CM-03, PR.AA-01, PR.AA-05…: related, not a mapping §164.312(a)(2)(ii) Emergency Access Procedure Loosely related Only shares CSF DE.CM-01, DE.CM-03, PR.AA-01, PR.AA-05…: related, not a mapping §164.308(a)(1)(ii)(D) Information System Activity Review Loosely related Only shares CSF DE.CM-01, DE.CM-03, PR.DS-10: related, not a mapping §164.308(a)(4)(ii)(A) Isolating Health care Clearinghouse Function Loosely related Only shares CSF PR.AA-05, PR.DS-10: related, not a mapping …and 18 more in the downloads
GDPR	Art.25(2)Art.32(1)(b)	Data protection by design and by default; Security of processing	Editorial	Same topic: Access Control (editorial pick) 4 loosely related (not mappings) Art.5(1)(e) Principles relating to processing of personal data Loosely related Only shares CSF PR.DS-10: related, not a mapping Art.5(1)(f) Principles relating to processing of personal data Loosely related Only shares CSF PR.DS-10: related, not a mapping Art.29 Processing under the authority of the controller or processor Loosely related Only shares CSF DE.CM-03: related, not a mapping Art.32(4) Security of processing Loosely related Only shares CSF DE.CM-03: related, not a mapping
NIS2	6.8 11.1 11.2 11.5 11.6	Network segmentation; Access control policy…	Crosswalk	Same topic: Zero Trust, Access Control 4 loosely related (not mappings) 4.3 Crisis management Loosely related Only shares CSF DE.CM-01: related, not a mapping 6.7 Network security Loosely related Only shares CSF DE.CM-01: related, not a mapping 6.9 Protection against malicious and unauthorised software Loosely related Only shares CSF DE.CM-01: related, not a mapping 11.4 Administration systems Loosely related Only shares CSF PR.AA-05: related, not a mapping
Essential Eight	ISM-0109 ISM-1906 ISM-1907 ISM-0445	Event logs from workstations are analysed in a timely manner to detect cyber security…; Event logs from internet-facing servers are analysed in a timely manner to detect cyber……	Loosely related	No mapping. Only shares CSF DE.CM-01, DE.CM-03, PR.AA-05: related, not a mapping +19 more loosely related (not mappings) ISM-1175 Privileged user accounts (excluding those explicitly authorised to access online… Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1380 Privileged human users use separate privileged and unprivileged operating environments Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1387 Administrative activities are conducted through jump servers Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1507 Requests for privileged access to systems and their resources are validated when first… Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 15 more in the downloads
DORA	Art.9(4)(c)	Protection and prevention	Editorial	Same topic: Access Control (editorial pick) 7 loosely related (not mappings) Art.9(1) Protection and prevention Loosely related Only shares CSF DE.CM-01, DE.CM-03: related, not a mapping Art.10(3) Detection Loosely related Only shares CSF DE.CM-01, DE.CM-03: related, not a mapping Art.9(2) Protection and prevention Loosely related Only shares CSF PR.DS-10: related, not a mapping Art.9(3)(c) Protection and prevention Loosely related Only shares CSF PR.DS-10: related, not a mapping Art.9(3)(d) Protection and prevention Loosely related Only shares CSF PR.DS-10: related, not a mapping Art.10(1) Detection Loosely related Only shares CSF DE.CM-01: related, not a mapping Art.10(2) Detection Loosely related Only shares CSF DE.CM-01: related, not a mapping
CPS 234	Para 21 Para 23	Timely controls commensurate with risk and asset life-cycle; Detect and respond to incidents in a timely manner	Loosely related	No mapping. Only shares CSF PR.DS-10, DE.CM-01: related, not a mapping
Cyber Essentials	CE 4	User Access Control	Editorial	Same topic: Access Control (editorial pick) 1 loosely related (not mappings) CE 2 Secure Configuration Loosely related Only shares CSF PR.AA-05: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.