Access control

frameworkISO/IEC 27001:2022 sectionA.5 Organizational controls csf 2.0PR.AA-01 PR.AA-03 PR.AA-05 PR.DS-01 PR.DS-02 PR.DS-10 topicsAccess Control, Zero Trust frameworks7 4 0

Official text · not licensableTitle: Access control. The control text is ISO's copyright; see ISO/IEC 27001:2022.

gap from ISO 27001 → gap to ISO 27001 →

Wrong or missing mapping? Report it

Equivalents of A.5.15 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	PR.AA-01 PR.AA-03 PR.AA-04 PR.AA-05 PR.IR-01	Identities and credentials for authorized users, services, and hardware are managed by the organization; Users, services, and hardware are authenticated…	Crosswalk	Same topic: Access Control, Zero Trust 3 loosely related (not mappings) PR.DS-01 The confidentiality, integrity, and availability of data-at-rest are protected Loosely related Only shares CSF PR.DS-01: related, not a mapping PR.DS-02 The confidentiality, integrity, and availability of data-in-transit are protected Loosely related Only shares CSF PR.DS-02: related, not a mapping PR.DS-10 The confidentiality, integrity, and availability of data-in-use are protected Loosely related Only shares CSF PR.DS-10: related, not a mapping
CIS v8.1	CIS 3.3 CIS 5.1 CIS 5.6 CIS 6.7 CIS 6.8 CIS 12.2 CIS 5.2 CIS 5.3 CIS 5.5 CIS 6.1 CIS 6.2 CIS 6.6 CIS 12.5 CIS 12.7 CIS 13.5	Configure Data Access Control Lists; Establish and Maintain an Inventory of Accounts…	Crosswalk	Same topic: Access Control, Zero Trust 24 loosely related (not mappings) CIS 3.10 Encrypt Sensitive Data in Transit Loosely related Only shares CSF PR.DS-02: related, not a mapping CIS 3.11 Encrypt Sensitive Data at Rest Loosely related Only shares CSF PR.DS-01: related, not a mapping CIS 3.1 Establish and Maintain a Data Management Process Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CIS 3.4 Enforce Data Retention Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CIS 3.5 Securely Dispose of Data Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CIS 3.12 Segment Data Processing and Storage Based on Sensitivity Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CIS 3.13 Deploy a Data Loss Prevention Solution Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CIS 3.6 Encrypt Data on End-User Devices Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping …and 16 more in the downloads
SOC 2	CC6.1 CC6.2 CC6.3 CC6.6	Logical access security over information assets; User registration, authorization and removal…	Editorial	Same topic: Access Control, Zero Trust (editorial pick) 4 loosely related (not mappings) CC6.7 Restricting transmission, movement and removal of information Loosely related Only shares CSF PR.AA-05, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping C1.2 Disposing of confidential information Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CC6.5 Protection of data when assets are disposed of Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CC6.8 Preventing or detecting unauthorized or malicious software Loosely related Only shares CSF PR.DS-02: related, not a mapping
PCI DSS	7.2.1 7.2.2 7.2.4 8.2.1 8.3.1	Access control model defined; Access assigned by job function and least privilege…	Crosswalk	Same topic: Access Control, Zero Trust 43 loosely related (not mappings) 2.3.1 Wireless vendor defaults changed Loosely related Only shares CSF PR.AA-03, PR.DS-02: related, not a mapping 3.5.1.3 Disk encryption access managed separately from OS access Loosely related Only shares CSF PR.AA-03, PR.DS-01: related, not a mapping 3.6.1 Procedures protect keys that secure stored account data Loosely related Only shares CSF PR.AA-01, PR.DS-01: related, not a mapping 3.6.1.1 Service providers document their cryptographic architecture Loosely related Only shares CSF PR.AA-01, PR.DS-01: related, not a mapping 3.6.1.2 Secret and private keys stored in approved forms Loosely related Only shares CSF PR.AA-01, PR.DS-01: related, not a mapping 3.6.1.3 Cleartext key components accessible to fewest custodians Loosely related Only shares CSF PR.AA-01, PR.DS-01: related, not a mapping 3.6.1.4 Keys stored in the fewest possible locations Loosely related Only shares CSF PR.AA-01, PR.DS-01: related, not a mapping 8.2.8 Re-authentication after 15 minutes idle Loosely related Only shares CSF PR.AA-03, PR.DS-10: related, not a mapping …and 35 more in the downloads
CMMC	AC.L2-3.1.1 AC.L2-3.1.2 SC.L2-3.13.1 SC.L2-3.13.6	Authorized Access Control; Transaction & Function Control…	Crosswalk	Same topic: Access Control, Zero Trust 47 loosely related (not mappings) AC.L2-3.1.13 Remote Access Confidentiality Loosely related Only shares CSF PR.AA-05, PR.DS-01, PR.DS-02: related, not a mapping AC.L2-3.1.19 Encrypt CUI on Mobile Loosely related Only shares CSF PR.AA-05, PR.DS-01, PR.DS-02: related, not a mapping MP.L2-3.8.6 Portable Storage Encryption Loosely related Only shares CSF PR.AA-05, PR.DS-01, PR.DS-02: related, not a mapping SC.L2-3.13.2 Security Engineering Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC.L2-3.13.3 Role Separation Loosely related Only shares CSF PR.AA-01, PR.AA-05, PR.DS-10: related, not a mapping SC.L2-3.13.4 Shared Resource Control Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC.L2-3.13.5 Public-Access System Separation Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC.L2-3.13.8 Data in Transit Loosely related Only shares CSF PR.AA-05, PR.DS-01, PR.DS-02: related, not a mapping …and 39 more in the downloads
800-53	AC-2 AC-3 AC-4 AC-6 IA-2 AC-1	Account Management; Access Enforcement…	Crosswalk	Same topic: Access Control, Zero Trust NIST SP 800-53 → ISO 27001 mapping 52 loosely related (not mappings) CA-3 Information Exchange Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC-4 Information in Shared System Resources Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC-7 Boundary Protection Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC-13 Cryptographic Protection Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC-43 Usage Restrictions Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SI-3 Malicious Code Protection Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SI-4 System Monitoring Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SI-7 Software, Firmware, and Information Integrity Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping …and 44 more in the downloads
HIPAA	§164.308(a)(4)§164.312(a)§164.312(a)(2)(i)§164.312(d)	Information Access Management; Access Control…	Crosswalk	Same topic: Access Control 26 loosely related (not mappings) §164.308(a)(4)(ii)(A) Isolating Health care Clearinghouse Function Loosely related Only shares CSF PR.AA-05, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping §164.308(a)(1)(ii)(D) Information System Activity Review Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping §164.308(a)(3) Workforce Security Loosely related Only shares CSF PR.AA-01, PR.AA-05, PR.DS-10: related, not a mapping §164.308(a)(3)(ii)(A) Authorization and/or Supervision Loosely related Only shares CSF PR.AA-01, PR.AA-05, PR.DS-10: related, not a mapping §164.308(a)(3)(ii)(B) Workforce Clearance Procedure Loosely related Only shares CSF PR.AA-01, PR.AA-05, PR.DS-10: related, not a mapping §164.308(a)(4)(ii)(B) Access Authorization Loosely related Only shares CSF PR.AA-01, PR.AA-05, PR.DS-10: related, not a mapping §164.308(a)(4)(ii)(C) Access Establishment and Modification Loosely related Only shares CSF PR.AA-01, PR.AA-05, PR.DS-10: related, not a mapping §164.308(b)(1) Business Associate Contracts and Other Arrangements Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping …and 18 more in the downloads
GDPR	Art.25(2)Art.32(1)(b)	Data protection by design and by default; Security of processing	Editorial	Same topic: Access Control (editorial pick) 4 loosely related (not mappings) Art.5(1)(e) Principles relating to processing of personal data Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping Art.5(1)(f) Principles relating to processing of personal data Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping Art.32(1)(a) Security of processing Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping Art.34(3)(a) Communication of a personal data breach to the data subject Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping
NIS2	6.8 11.1 11.2 11.5 11.6	Network segmentation; Access control policy…	Crosswalk	Same topic: Zero Trust, Access Control 4 loosely related (not mappings) 9.1 Cryptography Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping 11.7 Multi-factor authentication Loosely related Only shares CSF PR.AA-03: related, not a mapping 12.3 Removable media policy Loosely related Only shares CSF PR.DS-01: related, not a mapping 11.4 Administration systems Loosely related Only shares CSF PR.AA-05: related, not a mapping
Essential Eight	ISM-0445 ISM-0974 ISM-1173 ISM-1175	Privileged human users are assigned a dedicated privileged user account to be used…; Multi-factor authentication is used to authenticate unprivileged human users of systems…	Loosely related	No mapping. Only shares CSF PR.AA-05, PR.AA-03: related, not a mapping +33 more loosely related (not mappings) ISM-1380 Privileged human users use separate privileged and unprivileged operating environments Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1387 Administrative activities are conducted through jump servers Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1401 Multi-factor authentication uses either: something people have and something people… Loosely related Only shares CSF PR.AA-03: related, not a mapping ISM-1488 Microsoft Office macros in files originating from the internet are blocked Loosely related Only shares CSF PR.DS-02: related, not a mapping …and 29 more in the downloads
DORA	Art.9(4)(c)	Protection and prevention	Editorial	Same topic: Access Control (editorial pick) 5 loosely related (not mappings) Art.9(2) Protection and prevention Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping Art.9(3)(c) Protection and prevention Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping Art.9(3)(d) Protection and prevention Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping Art.9(4)(d) Protection and prevention Loosely related Only shares CSF PR.AA-03, PR.DS-01, PR.DS-02: related, not a mapping Art.9(3)(a) Protection and prevention Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping
CPS 234	Para 21	Timely controls commensurate with risk and asset life-cycle	Loosely related	No mapping. Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping
Cyber Essentials	CE 4	User Access Control	Editorial	Same topic: Access Control (editorial pick) 1 loosely related (not mappings) CE 2 Secure Configuration Loosely related Only shares CSF PR.AA-05: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.