Authentication information

frameworkISO/IEC 27001:2022 sectionA.5 Organizational controls csf 2.0PR.AA-03 PR.AA-05 topics— frameworks2 0 1

Official text · not licensableTitle: Authentication information. The control text is ISO's copyright; see ISO/IEC 27001:2022.

gap from ISO 27001 → gap to ISO 27001 →

Wrong or missing mapping? Report it

Equivalents of A.5.17 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	PR.AA-03 PR.AA-05	Users, services, and hardware are authenticated; Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties	Loosely related	No mapping. Only shares CSF PR.AA-03, PR.AA-05: related, not a mapping
CIS v8.1	CIS 3.3 CIS 5.1 CIS 6.8 CIS 12.7	Configure Data Access Control Lists; Establish and Maintain an Inventory of Accounts…	Loosely related	No mapping. Only shares CSF PR.AA-05, PR.AA-03: related, not a mapping +18 more loosely related (not mappings) CIS 13.5 Manage Access Control for Remote Assets Loosely related Only shares CSF PR.AA-03, PR.AA-05: related, not a mapping CIS 4.10 Enforce Automatic Device Lockout on Portable End-User Devices Loosely related Only shares CSF PR.AA-05: related, not a mapping CIS 4.11 Enforce Remote Wipe Capability on Portable End-User Devices Loosely related Only shares CSF PR.AA-05: related, not a mapping CIS 4.12 Separate Enterprise Workspaces on Mobile End-User Devices Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 14 more in the downloads
SOC 2	CC6.1 CC6.6 CC6.2 CC6.3	Logical access security over information assets; Protection against threats from outside system boundaries…	Loosely related	No mapping. Only shares CSF PR.AA-03, PR.AA-05: related, not a mapping +1 more loosely related (not mappings) CC6.7 Restricting transmission, movement and removal of information Loosely related Only shares CSF PR.AA-05: related, not a mapping
PCI DSS	2.2.2 2.3.1 3.5.1.3 7.1.1	Vendor default accounts managed or removed; Wireless vendor defaults changed…	Loosely related	No mapping. Only shares CSF PR.AA-03, PR.AA-05: related, not a mapping +21 more loosely related (not mappings) 7.2.1 Access control model defined Loosely related Only shares CSF PR.AA-05: related, not a mapping 7.2.2 Access assigned by job function and least privilege Loosely related Only shares CSF PR.AA-05: related, not a mapping 7.2.4 User accounts and privileges reviewed every six months Loosely related Only shares CSF PR.AA-05: related, not a mapping 7.2.5.1 System and application account access periodically reviewed Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 17 more in the downloads
CMMC	AC.L2-3.1.1 AC.L2-3.1.2 AC.L2-3.1.4 AC.L2-3.1.5	Authorized Access Control; Transaction & Function Control…	Loosely related	No mapping. Only shares CSF PR.AA-05: related, not a mapping +26 more loosely related (not mappings) AC.L2-3.1.6 Non-Privileged Account Use Loosely related Only shares CSF PR.AA-05: related, not a mapping AC.L2-3.1.7 Privileged Functions Loosely related Only shares CSF PR.AA-05: related, not a mapping AC.L2-3.1.8 Unsuccessful Logon Attempts Loosely related Only shares CSF PR.AA-03: related, not a mapping AC.L2-3.1.11 Session Termination Loosely related Only shares CSF PR.AA-03: related, not a mapping …and 22 more in the downloads
800-53	IA-5	Authenticator Management	Crosswalk	NIST SP 800-53 → ISO 27001 mapping 26 loosely related (not mappings) AC-2 Account Management Loosely related Only shares CSF PR.AA-05: related, not a mapping AC-3 Access Enforcement Loosely related Only shares CSF PR.AA-05: related, not a mapping AC-5 Separation of Duties Loosely related Only shares CSF PR.AA-05: related, not a mapping AC-6 Least Privilege Loosely related Only shares CSF PR.AA-05: related, not a mapping AC-7 Unsuccessful Logon Attempts Loosely related Only shares CSF PR.AA-03: related, not a mapping AC-10 Concurrent Session Control Loosely related Only shares CSF PR.AA-05: related, not a mapping AC-12 Session Termination Loosely related Only shares CSF PR.AA-03: related, not a mapping AC-16 Security and Privacy Attributes Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 18 more in the downloads
HIPAA	§164.310(b)§164.312(a)(2)(i)§164.312(d)§164.308(a)(3)	Workstation Use; Unique User Identification…	Loosely related	No mapping. Only shares CSF PR.AA-03, PR.AA-05: related, not a mapping +12 more loosely related (not mappings) §164.308(a)(3)(ii)(A) Authorization and/or Supervision Loosely related Only shares CSF PR.AA-05: related, not a mapping §164.308(a)(3)(ii)(B) Workforce Clearance Procedure Loosely related Only shares CSF PR.AA-05: related, not a mapping §164.308(a)(4) Information Access Management Loosely related Only shares CSF PR.AA-05: related, not a mapping §164.308(a)(4)(ii)(A) Isolating Health care Clearinghouse Function Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 8 more in the downloads
GDPR	Art.25(2)Art.32(1)(b)	Data protection by design and by default; Security of processing	Loosely related	No mapping. Only shares CSF PR.AA-05: related, not a mapping
NIS2	11.6	Authentication	Crosswalk	ENISA NIS2 → ISO 27001 mapping 5 loosely related (not mappings) 11.1 Access control policy Loosely related Only shares CSF PR.AA-05: related, not a mapping 11.2 Management of access rights Loosely related Only shares CSF PR.AA-05: related, not a mapping 11.5 Identification Loosely related Only shares CSF PR.AA-05: related, not a mapping 11.7 Multi-factor authentication Loosely related Only shares CSF PR.AA-03: related, not a mapping 11.4 Administration systems Loosely related Only shares CSF PR.AA-05: related, not a mapping
Essential Eight	ISM-0445 ISM-0974 ISM-1173 ISM-1175	Privileged human users are assigned a dedicated privileged user account to be used…; Multi-factor authentication is used to authenticate unprivileged human users of systems…	Loosely related	No mapping. Only shares CSF PR.AA-05, PR.AA-03: related, not a mapping +32 more loosely related (not mappings) ISM-1380 Privileged human users use separate privileged and unprivileged operating environments Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1387 Administrative activities are conducted through jump servers Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1401 Multi-factor authentication uses either: something people have and something people… Loosely related Only shares CSF PR.AA-03: related, not a mapping ISM-1504 Multi-factor authentication is used to authenticate human users to their organisation’s online services that process… Loosely related Only shares CSF PR.AA-03: related, not a mapping …and 28 more in the downloads
DORA	Art.9(4)(c)Art.9(4)(d)	Protection and prevention; Protection and prevention	Loosely related	No mapping. Only shares CSF PR.AA-05, PR.AA-03: related, not a mapping
CPS 234	—	No requirement	No mapping in our data	No mapping in our data (CPS 234 is principles-based and its links are editorial).
Cyber Essentials	CE 4 CE 2	User Access Control; Secure Configuration	Loosely related	No mapping. Only shares CSF PR.AA-03, PR.AA-05: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.