CMMC · AC Access Control
AC.L2-3.1.19
Encrypt CUI on Mobile
frameworkCMMC Level 2
sectionAC Access Control
csf 2.0PR.AA-05 PR.DS-01 PR.DS-02
topicsEncryption, Mobile Security
frameworks3 8 0
Official textEncrypt CUI on mobile devices and mobile computing platforms.NIST SP 800-171 Rev 2 requirement, the basis of the CMMC Level 2 practice (public domain)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | PR.AA-05PR.PS-01PR.DS-01PR.DS-02 | Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties; Configuration management practices are established and applied… | Crosswalk | Same topic: Mobile Security, Encryption |
| ISO 27001 | A.8.1A.6.7A.8.24 | User endpoint devices; Remote working… | Crosswalk | Same topic: Mobile Security, Encryption36 loosely related (not mappings)A.8.3 Information access restriction Only shares CSF PR.AA-05, PR.DS-01, PR.DS-02: related, not a mapping …and 28 more in the downloads |
| CIS v8.1 | CIS 3.6CIS 3.9CIS 3.10CIS 3.11CIS 4.10CIS 4.11CIS 4.12 | Encrypt Data on End-User Devices; Encrypt Data on Removable Media… | Editorial | Same topic: Encryption, Mobile Security (editorial pick)24 loosely related (not mappings)CIS 5.1 Establish and Maintain an Inventory of Accounts Only shares CSF PR.AA-05: related, not a mapping CIS 6.8 Define and Maintain Role-Based Access Control Only shares CSF PR.AA-05: related, not a mapping CIS 3.1 Establish and Maintain a Data Management Process Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping CIS 3.12 Segment Data Processing and Storage Based on Sensitivity Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping CIS 3.13 Deploy a Data Loss Prevention Solution Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping …and 16 more in the downloads |
| SOC 2 | CC6.1CC6.7 | Logical access security over information assets; Restricting transmission, movement and removal of information | Editorial | Same topic: Encryption, Mobile Security (editorial pick)6 loosely related (not mappings)C1.2 Disposing of confidential information Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping CC6.5 Protection of data when assets are disposed of Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping CC6.3 Role-based access, least privilege and segregation of duties Only shares CSF PR.AA-05: related, not a mapping CC6.6 Protection against threats from outside system boundaries Only shares CSF PR.AA-05: related, not a mapping CC6.8 Preventing or detecting unauthorized or malicious software Only shares CSF PR.DS-02: related, not a mapping |
| PCI DSS | 3.5.13.6.13.7.13.7.44.2.14.2.1.1 | PAN rendered unreadable wherever stored; Procedures protect keys that secure stored account data… | Editorial | Same topic: Encryption (editorial pick)20 loosely related (not mappings)7.1.1 Access restriction policies documented and kept current Only shares CSF PR.AA-05: related, not a mapping 7.2.2 Access assigned by job function and least privilege Only shares CSF PR.AA-05: related, not a mapping 7.2.4 User accounts and privileges reviewed every six months Only shares CSF PR.AA-05: related, not a mapping 7.2.5.1 System and application account access periodically reviewed Only shares CSF PR.AA-05: related, not a mapping 8.1.1 Identification and authentication policies documented Only shares CSF PR.AA-05: related, not a mapping 8.2.6 Inactive user accounts disabled within 90 days Only shares CSF PR.AA-05: related, not a mapping …and 12 more in the downloads |
| 800-53 | AC-19AC-19(5)SC-8SC-12SC-13SC-28 | Access Control for Mobile Devices; Full Device or Container-based Encryption… | Crosswalk | Same topic: Mobile Security, Encryption29 loosely related (not mappings)…and 21 more in the downloads |
| HIPAA | §164.310(d)§164.312(a)(2)(iv)§164.312(e)(2)(ii) | Device and Media Controls; Encryption and Decryption… | Editorial | Same topic: Mobile Security, Encryption (editorial pick)26 loosely related (not mappings)§164.308(a)(4)(ii)(A) Isolating Health care Clearinghouse Function Only shares CSF PR.AA-05, PR.DS-01, PR.DS-02: related, not a mapping §164.308(a)(3)(ii)(A) Authorization and/or Supervision Only shares CSF PR.AA-05: related, not a mapping §164.308(a)(3)(ii)(B) Workforce Clearance Procedure Only shares CSF PR.AA-05: related, not a mapping §164.308(a)(4)(ii)(C) Access Establishment and Modification Only shares CSF PR.AA-05: related, not a mapping …and 18 more in the downloads |
| GDPR | Art.32(1)(a)Art.34(3)(a) | Security of processing; Communication of a personal data breach to the data subject | Editorial | Same topic: Encryption (editorial pick)4 loosely related (not mappings)Art.32(1)(b) Security of processing Only shares CSF PR.AA-05, PR.DS-01, PR.DS-02: related, not a mapping Art.5(1)(e) Principles relating to processing of personal data Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping Art.5(1)(f) Principles relating to processing of personal data Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping |
| NIS2 | 9.1 | Cryptography | Editorial | Same topic: Encryption (editorial pick)6 loosely related (not mappings) |
| Essential Eight | ISM-0445ISM-1175ISM-1380ISM-1387 | Privileged human users are assigned a dedicated privileged user account to be used…; Privileged user accounts (excluding those explicitly authorised to access online…… | No mapping. Only shares CSF PR.AA-05: related, not a mapping+17 more loosely related (not mappings)ISM-1488 Microsoft Office macros in files originating from the internet are blocked Only shares CSF PR.DS-02: related, not a mapping ISM-1507 Requests for privileged access to systems and their resources are validated when first… Only shares CSF PR.AA-05: related, not a mapping ISM-1508 Privileged access to systems and their resources is limited to only what is required… Only shares CSF PR.AA-05: related, not a mapping ISM-1509 Privileged access events are centrally logged Only shares CSF PR.AA-05: related, not a mapping …and 13 more in the downloads | |
| DORA | Art.9(3)(a)Art.9(4)(d) | Protection and prevention; Protection and prevention | Editorial | Same topic: Encryption (editorial pick)4 loosely related (not mappings) |
| CPS 234 | Para 21 | Timely controls commensurate with risk and asset life-cycle | No mapping. Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping | |
| Cyber Essentials | CE 2 | Secure Configuration | Editorial | Same topic: Mobile Security (editorial pick)1 loosely related (not mappings) |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.