Privileged user accounts explicitly authorised to access online services are strictly…

frameworkASD Essential Eight sectionRestrict administrative privileges levelsML1, ML2, ML3 csf 2.0PR.AA-05 topics— frameworks0 0 1

Official textPrivileged user accounts explicitly authorised to access online services are strictly limited to only what is required for users to undertake their duties or functions.Australian Signals Directorate, Information Security Manual (September 2026). © Commonwealth of Australia, CC BY 4.0

gap from Essential Eight → gap to Essential Eight →

Wrong or missing mapping? Report it

Equivalents of ISM-1883 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	PR.AA-05	Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties	Loosely related	No mapping. Only shares CSF PR.AA-05: related, not a mapping
ISO 27001	A.5.1 A.5.3 A.5.14 A.5.15	Policies for information security; Segregation of duties…	Loosely related	No mapping. Only shares CSF PR.AA-05: related, not a mapping +9 more loosely related (not mappings) A.5.16 Identity management Loosely related Only shares CSF PR.AA-05: related, not a mapping A.5.17 Authentication information Loosely related Only shares CSF PR.AA-05: related, not a mapping A.5.18 Access rights Loosely related Only shares CSF PR.AA-05: related, not a mapping A.6.7 Remote working Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 5 more in the downloads
CIS v8.1	CIS 3.3 CIS 4.10 CIS 4.11 CIS 4.12	Configure Data Access Control Lists; Enforce Automatic Device Lockout on Portable End-User Devices…	Loosely related	No mapping. Only shares CSF PR.AA-05: related, not a mapping +13 more loosely related (not mappings) CIS 5.1 Establish and Maintain an Inventory of Accounts Loosely related Only shares CSF PR.AA-05: related, not a mapping CIS 5.2 Use Unique Passwords Loosely related Only shares CSF PR.AA-05: related, not a mapping CIS 5.3 Disable Dormant Accounts Loosely related Only shares CSF PR.AA-05: related, not a mapping CIS 5.4 Restrict Administrator Privileges to Dedicated Administrator Accounts Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 9 more in the downloads
SOC 2	CC6.1 CC6.2 CC6.3 CC6.6	Logical access security over information assets; User registration, authorization and removal…	Loosely related	No mapping. Only shares CSF PR.AA-05: related, not a mapping +1 more loosely related (not mappings) CC6.7 Restricting transmission, movement and removal of information Loosely related Only shares CSF PR.AA-05: related, not a mapping
PCI DSS	7.1.1 7.2.1 7.2.2 7.2.4	Access restriction policies documented and kept current; Access control model defined…	Loosely related	No mapping. Only shares CSF PR.AA-05: related, not a mapping +4 more loosely related (not mappings) 7.2.5.1 System and application account access periodically reviewed Loosely related Only shares CSF PR.AA-05: related, not a mapping 8.1.1 Identification and authentication policies documented Loosely related Only shares CSF PR.AA-05: related, not a mapping 8.2.6 Inactive user accounts disabled within 90 days Loosely related Only shares CSF PR.AA-05: related, not a mapping 12.1.3 Security roles and responsibilities defined Loosely related Only shares CSF PR.AA-05: related, not a mapping
CMMC	AC.L2-3.1.1 AC.L2-3.1.2 AC.L2-3.1.4 AC.L2-3.1.5	Authorized Access Control; Transaction & Function Control…	Loosely related	No mapping. Only shares CSF PR.AA-05: related, not a mapping +16 more loosely related (not mappings) AC.L2-3.1.6 Non-Privileged Account Use Loosely related Only shares CSF PR.AA-05: related, not a mapping AC.L2-3.1.7 Privileged Functions Loosely related Only shares CSF PR.AA-05: related, not a mapping AC.L2-3.1.12 Control Remote Access Loosely related Only shares CSF PR.AA-05: related, not a mapping AC.L2-3.1.13 Remote Access Confidentiality Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 12 more in the downloads
800-53	AC-2 AC-2(7)AC-3 AC-5	Account Management; Privileged User Accounts…	Loosely related	No mapping. Only shares CSF PR.AA-05: related, not a mapping +10 more loosely related (not mappings) AC-6 Least Privilege Loosely related Only shares CSF PR.AA-05: related, not a mapping AC-6(5) Privileged Accounts Loosely related Only shares CSF PR.AA-05: related, not a mapping AC-10 Concurrent Session Control Loosely related Only shares CSF PR.AA-05: related, not a mapping AC-16 Security and Privacy Attributes Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 6 more in the downloads
HIPAA	§164.308(a)(3)§164.308(a)(3)(ii)(A)§164.308(a)(3)(ii)(B)§164.308(a)(4)	Workforce Security; Authorization and/or Supervision…	Loosely related	No mapping. Only shares CSF PR.AA-05: related, not a mapping +11 more loosely related (not mappings) §164.308(a)(4)(ii)(A) Isolating Health care Clearinghouse Function Loosely related Only shares CSF PR.AA-05: related, not a mapping §164.308(a)(4)(ii)(B) Access Authorization Loosely related Only shares CSF PR.AA-05: related, not a mapping §164.308(a)(4)(ii)(C) Access Establishment and Modification Loosely related Only shares CSF PR.AA-05: related, not a mapping §164.310(b) Workstation Use Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 7 more in the downloads
GDPR	Art.25(2)Art.32(1)(b)	Data protection by design and by default; Security of processing	Loosely related	No mapping. Only shares CSF PR.AA-05: related, not a mapping
NIS2	11.1 11.2 11.4 11.5	Access control policy; Management of access rights…	Loosely related	No mapping. Only shares CSF PR.AA-05: related, not a mapping +1 more loosely related (not mappings) 11.6 Authentication Loosely related Only shares CSF PR.AA-05: related, not a mapping
DORA	Art.9(4)(c)	Protection and prevention	Loosely related	No mapping. Only shares CSF PR.AA-05: related, not a mapping
CPS 234	—	No requirement	No mapping in our data	No mapping in our data (CPS 234 is principles-based and its links are editorial).
Cyber Essentials	CE 2 CE 4	Secure Configuration; User Access Control	Loosely related	No mapping. Only shares CSF PR.AA-05: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.