User Access Control

frameworkUK Cyber Essentials (NCSC) sectionTechnical controls csf 2.0ID.AM-04 PR.AA-01 PR.AA-03 PR.AA-05 PR.IR-01 PR.PS-01 topicsAccess Control, Multi-Factor Auth, Privileged Access, Cloud Security frameworks0 12 0

Official text · not licensableSee the official text of UK Cyber Essentials (NCSC).

gap from Cyber Essentials → gap to Cyber Essentials →

Wrong or missing mapping? Report it

Equivalents of CE 4 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	ID.AM-04 PR.AA-01 PR.AA-03 PR.AA-05 PR.IR-01 PR.PS-01	Inventories of services provided by suppliers are maintained; Identities and credentials for authorized users, services, and hardware are managed by the organization…	Editorial	Same topic: Cloud Security, Access Control, Multi-Factor Auth, Privileged Access (editorial pick)
ISO 27001	A.5.15 A.5.16 A.5.18 A.5.23 A.8.2 A.8.3 A.8.5 A.8.18	Access control; Identity management…	Editorial	Same topic: Access Control, Cloud Security, Privileged Access, Multi-Factor Auth (editorial pick) 14 loosely related (not mappings) A.5.17 Authentication information Loosely related Only shares CSF PR.AA-03, PR.AA-05: related, not a mapping A.6.7 Remote working Loosely related Only shares CSF PR.AA-05, PR.PS-01: related, not a mapping A.5.1 Policies for information security Loosely related Only shares CSF PR.AA-05: related, not a mapping A.5.3 Segregation of duties Loosely related Only shares CSF PR.AA-05: related, not a mapping A.5.14 Information transfer Loosely related Only shares CSF PR.AA-05: related, not a mapping A.5.22 Monitoring, review and change management of supplier services Loosely related Only shares CSF ID.AM-04: related, not a mapping A.8.4 Access to source code Loosely related Only shares CSF PR.AA-05: related, not a mapping A.8.8 Management of technical vulnerabilities Loosely related Only shares CSF PR.PS-01: related, not a mapping …and 6 more in the downloads
CIS v8.1	CIS 3.3 CIS 5.1 CIS 5.2 CIS 5.3 CIS 5.4 CIS 5.5 CIS 5.6 CIS 6.1 CIS 6.2 CIS 6.3 CIS 6.4 CIS 6.5 CIS 6.6 CIS 6.7 CIS 6.8 CIS 12.5 CIS 12.8 CIS 15.1	Configure Data Access Control Lists; Establish and Maintain an Inventory of Accounts…	Editorial	Same topic: Access Control, Privileged Access, Multi-Factor Auth, Cloud Security (editorial pick) 35 loosely related (not mappings) CIS 12.7 Ensure Remote Devices Utilize a VPN and are Connecting to an Enterprise's AAA Infrastructure Loosely related Only shares CSF PR.AA-03, PR.AA-05, PR.IR-01: related, not a mapping CIS 13.5 Manage Access Control for Remote Assets Loosely related Only shares CSF PR.AA-03, PR.AA-05, PR.IR-01: related, not a mapping CIS 4.10 Enforce Automatic Device Lockout on Portable End-User Devices Loosely related Only shares CSF PR.AA-05, PR.PS-01: related, not a mapping CIS 4.11 Enforce Remote Wipe Capability on Portable End-User Devices Loosely related Only shares CSF PR.AA-05, PR.PS-01: related, not a mapping CIS 4.12 Separate Enterprise Workspaces on Mobile End-User Devices Loosely related Only shares CSF PR.AA-05, PR.PS-01: related, not a mapping CIS 16.10 Apply Secure Design Principles in Application Architectures Loosely related Only shares CSF PR.AA-03, PR.IR-01: related, not a mapping CIS 16.12 Implement Code-Level Security Checks Loosely related Only shares CSF PR.AA-03, PR.IR-01: related, not a mapping CIS 1.2 Address Unauthorized Assets Loosely related Only shares CSF ID.AM-04: related, not a mapping …and 27 more in the downloads
SOC 2	CC6.1 CC6.2 CC6.3 CC9.2	Logical access security over information assets; User registration, authorization and removal…	Editorial	Same topic: Access Control, Multi-Factor Auth, Privileged Access, Cloud Security (editorial pick) 4 loosely related (not mappings) CC6.6 Protection against threats from outside system boundaries Loosely related Only shares CSF PR.AA-03, PR.AA-05, PR.IR-01: related, not a mapping CC6.7 Restricting transmission, movement and removal of information Loosely related Only shares CSF PR.AA-05, PR.PS-01: related, not a mapping CC5.2 General controls over technology Loosely related Only shares CSF PR.PS-01: related, not a mapping CC7.1 Detecting configuration changes and new vulnerabilities Loosely related Only shares CSF PR.PS-01: related, not a mapping
PCI DSS	7.2.1 7.2.2 7.2.4 8.2.1 8.4.1 8.4.2 8.4.3 8.5.1 12.8.1 12.8.5	Access control model defined; Access assigned by job function and least privilege…	Editorial	Same topic: Access Control, Privileged Access, Multi-Factor Auth, Cloud Security (editorial pick) 44 loosely related (not mappings) 2.2.2 Vendor default accounts managed or removed Loosely related Only shares CSF PR.AA-03, PR.PS-01: related, not a mapping 6.2.4 Coding techniques prevent common software attacks Loosely related Only shares CSF PR.AA-03, PR.IR-01: related, not a mapping 1.2.1 Configuration standards for network security controls Loosely related Only shares CSF PR.IR-01: related, not a mapping 1.2.3 Accurate network diagram maintained Loosely related Only shares CSF PR.IR-01: related, not a mapping 1.2.4 Accurate account-data flow diagram maintained Loosely related Only shares CSF PR.IR-01: related, not a mapping 1.3.1 Inbound traffic to the CDE restricted Loosely related Only shares CSF PR.IR-01: related, not a mapping 1.4.1 Network controls between trusted and untrusted networks Loosely related Only shares CSF PR.IR-01: related, not a mapping 2.2.1 System configuration standards developed and maintained Loosely related Only shares CSF PR.PS-01: related, not a mapping …and 36 more in the downloads
CMMC	AC.L2-3.1.1 AC.L2-3.1.2 AC.L2-3.1.5 AC.L2-3.1.6 AC.L2-3.1.7 AC.L2-3.1.20 IA.L2-3.5.3	Authorized Access Control; Transaction & Function Control…	Editorial	Same topic: Access Control, Privileged Access, Cloud Security, Multi-Factor Auth (editorial pick) 42 loosely related (not mappings) SC.L2-3.13.3 Role Separation Loosely related Only shares CSF PR.AA-01, PR.AA-05, PR.IR-01: related, not a mapping CM.L2-3.4.9 User-Installed Software Loosely related Only shares CSF PR.AA-05, PR.PS-01: related, not a mapping IA.L2-3.5.1 Identification Loosely related Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping IA.L2-3.5.2 Authentication Loosely related Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping IA.L2-3.5.4 Replay-Resistant Authentication Loosely related Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping IA.L2-3.5.7 Password Complexity Loosely related Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping IA.L2-3.5.8 Password Reuse Loosely related Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping IA.L2-3.5.9 Temporary Passwords Loosely related Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping …and 34 more in the downloads
800-53	AC-2 AC-2(7)AC-3 AC-6(5)AC-20 IA-2(1)IA-2(2)SA-9	Account Management; Privileged User Accounts…	Editorial	Same topic: Access Control, Privileged Access, Cloud Security, Multi-Factor Auth (editorial pick) 42 loosely related (not mappings) AC-19(5) Full Device or Container-based Encryption Loosely related Only shares CSF PR.AA-05, PR.PS-01: related, not a mapping IA-2 Identification and Authentication (Organizational Users) Loosely related Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping IA-3 Device Identification and Authentication Loosely related Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping IA-5 Authenticator Management Loosely related Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping IA-7 Cryptographic Module Authentication Loosely related Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping IA-8 Identification and Authentication (Non-organizational Users) Loosely related Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping IA-9 Service Identification and Authentication Loosely related Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping IA-10 Adaptive Authentication Loosely related Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping …and 34 more in the downloads
HIPAA	§164.308(a)(4)§164.308(b)(1)§164.312(a)§164.312(a)(2)(i)§164.312(d)	Information Access Management; Business Associate Contracts and Other Arrangements…	Editorial	Same topic: Access Control, Cloud Security (editorial pick) 19 loosely related (not mappings) §164.308(a)(3) Workforce Security Loosely related Only shares CSF PR.AA-01, PR.AA-05, PR.IR-01: related, not a mapping §164.308(a)(3)(ii)(A) Authorization and/or Supervision Loosely related Only shares CSF PR.AA-01, PR.AA-05, PR.IR-01: related, not a mapping §164.308(a)(4)(ii)(B) Access Authorization Loosely related Only shares CSF PR.AA-01, PR.AA-05, PR.IR-01: related, not a mapping §164.310(b) Workstation Use Loosely related Only shares CSF PR.AA-03, PR.AA-05, PR.IR-01: related, not a mapping §164.312(a)(2)(ii) Emergency Access Procedure Loosely related Only shares CSF PR.AA-01, PR.AA-05, PR.IR-01: related, not a mapping §164.316(b)(2)(ii) Availability Loosely related Only shares CSF PR.AA-01, PR.AA-05, PR.PS-01: related, not a mapping §164.316(b)(2)(iii) Updates Loosely related Only shares CSF PR.AA-01, PR.AA-05, PR.PS-01: related, not a mapping §164.308(a)(3)(ii)(B) Workforce Clearance Procedure Loosely related Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping …and 11 more in the downloads
GDPR	Art.25(2)Art.28(1)Art.32(1)(b)	Data protection by design and by default; Processor…	Editorial	Same topic: Access Control, Cloud Security (editorial pick) 1 loosely related (not mappings) Art.30(1) Records of processing activities Loosely related Only shares CSF ID.AM-04: related, not a mapping
NIS2	6.1 11.1 11.2 11.3 11.4 11.5 11.6 11.7	Security in acquisition of ICT services, ICT systems or ICT products; Access control policy…	Editorial	Same topic: Cloud Security, Access Control, Privileged Access, Multi-Factor Auth (editorial pick) 4 loosely related (not mappings) 6.3 Configuration management Loosely related Only shares CSF PR.PS-01: related, not a mapping 6.7 Network security Loosely related Only shares CSF PR.IR-01: related, not a mapping 6.8 Network segmentation Loosely related Only shares CSF PR.IR-01: related, not a mapping 12.4 Asset inventory Loosely related Only shares CSF ID.AM-04: related, not a mapping
Essential Eight	ISM-0445 ISM-0974 ISM-1173 ISM-1175 ISM-1380 ISM-1387 ISM-1401 ISM-1504 ISM-1507 ISM-1508 ISM-1647 ISM-1648 ISM-1679 ISM-1872	Privileged human users are assigned a dedicated privileged user account to be used…; Multi-factor authentication is used to authenticate unprivileged human users of systems…	Editorial	Same topic: Privileged Access, Multi-Factor Auth (editorial pick) 54 loosely related (not mappings) ISM-1412 Web browsers are hardened using ASD and vendor hardening guidance, with the most… Loosely related Only shares CSF PR.PS-01: related, not a mapping ISM-1485 Web browsers do not process web advertisements from the internet Loosely related Only shares CSF PR.PS-01: related, not a mapping ISM-1486 Web browsers do not process Java from the internet Loosely related Only shares CSF PR.PS-01: related, not a mapping ISM-1487 Only privileged human users responsible for checking that Microsoft Office macros are… Loosely related Only shares CSF PR.PS-01: related, not a mapping ISM-1488 Microsoft Office macros in files originating from the internet are blocked Loosely related Only shares CSF PR.PS-01: related, not a mapping ISM-1489 Microsoft Office macro security settings cannot be changed by human users Loosely related Only shares CSF PR.PS-01: related, not a mapping ISM-1505 Multi-factor authentication is used to authenticate human users of data repositories Loosely related Only shares CSF PR.AA-03: related, not a mapping ISM-1509 Privileged access events are centrally logged Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 46 more in the downloads
DORA	Art.9(4)(c)Art.9(4)(d)Art.28(8)Art.30(2)	Protection and prevention; Protection and prevention…	Editorial	Same topic: Access Control, Privileged Access, Multi-Factor Auth, Cloud Security (editorial pick) 4 loosely related (not mappings) Art.8(1) Identification Loosely related Only shares CSF ID.AM-04: related, not a mapping Art.8(4) Identification Loosely related Only shares CSF ID.AM-04: related, not a mapping Art.8(6) Identification Loosely related Only shares CSF ID.AM-04: related, not a mapping Art.9(4)(b) Protection and prevention Loosely related Only shares CSF PR.IR-01: related, not a mapping
CPS 234	Para 20	Classify information assets by criticality and sensitivity	Loosely related	No mapping. Only shares CSF ID.AM-04: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.