Access rights

frameworkISO/IEC 27001:2022 sectionA.5 Organizational controls csf 2.0PR.AA-01 PR.AA-03 PR.AA-05 topicsAccess Control frameworks7 4 1

Official text · not licensableTitle: Access rights. The control text is ISO's copyright; see ISO/IEC 27001:2022.

gap from ISO 27001 → gap to ISO 27001 →

Wrong or missing mapping? Report it

Equivalents of A.5.18 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	PR.AA-01 PR.AA-05	Identities and credentials for authorized users, services, and hardware are managed by the organization; Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties	Crosswalk	Same topic: Access Control 1 loosely related (not mappings) PR.AA-03 Users, services, and hardware are authenticated Loosely related Only shares CSF PR.AA-03: related, not a mapping
CIS v8.1	CIS 3.3 CIS 5.1 CIS 5.6 CIS 6.7 CIS 6.8 CIS 5.2 CIS 5.3 CIS 5.5 CIS 6.1 CIS 6.2 CIS 6.6 CIS 12.5	Configure Data Access Control Lists; Establish and Maintain an Inventory of Accounts…	Crosswalk	Same topic: Access Control 12 loosely related (not mappings) CIS 12.7 Ensure Remote Devices Utilize a VPN and are Connecting to an Enterprise's AAA Infrastructure Loosely related Only shares CSF PR.AA-03, PR.AA-05: related, not a mapping CIS 13.5 Manage Access Control for Remote Assets Loosely related Only shares CSF PR.AA-03, PR.AA-05: related, not a mapping CIS 4.10 Enforce Automatic Device Lockout on Portable End-User Devices Loosely related Only shares CSF PR.AA-05: related, not a mapping CIS 4.11 Enforce Remote Wipe Capability on Portable End-User Devices Loosely related Only shares CSF PR.AA-05: related, not a mapping CIS 4.12 Separate Enterprise Workspaces on Mobile End-User Devices Loosely related Only shares CSF PR.AA-05: related, not a mapping CIS 5.4 Restrict Administrator Privileges to Dedicated Administrator Accounts Loosely related Only shares CSF PR.AA-05: related, not a mapping CIS 6.3 Require MFA for Externally-Exposed Applications Loosely related Only shares CSF PR.AA-03: related, not a mapping CIS 6.4 Require MFA for Remote Network Access Loosely related Only shares CSF PR.AA-03: related, not a mapping …and 4 more in the downloads
SOC 2	CC6.1 CC6.2 CC6.3	Logical access security over information assets; User registration, authorization and removal…	Editorial	Same topic: Access Control (editorial pick) 2 loosely related (not mappings) CC6.6 Protection against threats from outside system boundaries Loosely related Only shares CSF PR.AA-03, PR.AA-05: related, not a mapping CC6.7 Restricting transmission, movement and removal of information Loosely related Only shares CSF PR.AA-05: related, not a mapping
PCI DSS	7.2.1 7.2.2 7.2.4 8.2.1	Access control model defined; Access assigned by job function and least privilege…	Crosswalk	Same topic: Access Control 31 loosely related (not mappings) 2.2.2 Vendor default accounts managed or removed Loosely related Only shares CSF PR.AA-03: related, not a mapping 2.3.1 Wireless vendor defaults changed Loosely related Only shares CSF PR.AA-03: related, not a mapping 3.5.1.3 Disk encryption access managed separately from OS access Loosely related Only shares CSF PR.AA-03: related, not a mapping 3.6.1 Procedures protect keys that secure stored account data Loosely related Only shares CSF PR.AA-01: related, not a mapping 3.6.1.1 Service providers document their cryptographic architecture Loosely related Only shares CSF PR.AA-01: related, not a mapping 3.6.1.2 Secret and private keys stored in approved forms Loosely related Only shares CSF PR.AA-01: related, not a mapping 3.6.1.3 Cleartext key components accessible to fewest custodians Loosely related Only shares CSF PR.AA-01: related, not a mapping 3.6.1.4 Keys stored in the fewest possible locations Loosely related Only shares CSF PR.AA-01: related, not a mapping …and 23 more in the downloads
CMMC	AC.L2-3.1.1 AC.L2-3.1.2	Authorized Access Control; Transaction & Function Control	Crosswalk	Same topic: Access Control 31 loosely related (not mappings) IA.L2-3.5.1 Identification Loosely related Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping IA.L2-3.5.2 Authentication Loosely related Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping IA.L2-3.5.3 Multifactor Authentication Loosely related Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping IA.L2-3.5.4 Replay-Resistant Authentication Loosely related Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping IA.L2-3.5.7 Password Complexity Loosely related Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping IA.L2-3.5.8 Password Reuse Loosely related Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping IA.L2-3.5.9 Temporary Passwords Loosely related Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping IA.L2-3.5.10 Cryptographically-Protected Passwords Loosely related Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping …and 23 more in the downloads
800-53	AC-2 AC-3	Account Management; Access Enforcement	Crosswalk	Same topic: Access Control 28 loosely related (not mappings) IA-2 Identification and Authentication (Organizational Users) Loosely related Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping IA-3 Device Identification and Authentication Loosely related Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping IA-5 Authenticator Management Loosely related Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping IA-7 Cryptographic Module Authentication Loosely related Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping IA-8 Identification and Authentication (Non-organizational Users) Loosely related Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping IA-9 Service Identification and Authentication Loosely related Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping IA-10 Adaptive Authentication Loosely related Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping IA-11 Re-authentication Loosely related Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping …and 20 more in the downloads
HIPAA	§164.308(a)(4)§164.312(a)§164.312(a)(2)(i)§164.312(d)	Information Access Management; Access Control…	Crosswalk	Same topic: Access Control 12 loosely related (not mappings) §164.308(a)(3) Workforce Security Loosely related Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping §164.308(a)(3)(ii)(A) Authorization and/or Supervision Loosely related Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping §164.308(a)(3)(ii)(B) Workforce Clearance Procedure Loosely related Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping §164.308(a)(4)(ii)(B) Access Authorization Loosely related Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping §164.308(a)(4)(ii)(C) Access Establishment and Modification Loosely related Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping §164.310(b) Workstation Use Loosely related Only shares CSF PR.AA-03, PR.AA-05: related, not a mapping §164.312(a)(2)(ii) Emergency Access Procedure Loosely related Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping §164.316(b)(2)(ii) Availability Loosely related Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping …and 4 more in the downloads
GDPR	Art.25(2)Art.32(1)(b)	Data protection by design and by default; Security of processing	Editorial	Same topic: Access Control (editorial pick)
NIS2	11.1 11.2 11.5 12.5	Access control policy; Management of access rights…	Crosswalk	Same topic: Access Control ENISA NIS2 → ISO 27001 mapping 3 loosely related (not mappings) 11.6 Authentication Loosely related Only shares CSF PR.AA-03, PR.AA-05: related, not a mapping 11.7 Multi-factor authentication Loosely related Only shares CSF PR.AA-03: related, not a mapping 11.4 Administration systems Loosely related Only shares CSF PR.AA-05: related, not a mapping
Essential Eight	ISM-0445 ISM-0974 ISM-1173 ISM-1175	Privileged human users are assigned a dedicated privileged user account to be used…; Multi-factor authentication is used to authenticate unprivileged human users of systems…	Loosely related	No mapping. Only shares CSF PR.AA-05, PR.AA-03: related, not a mapping +32 more loosely related (not mappings) ISM-1380 Privileged human users use separate privileged and unprivileged operating environments Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1387 Administrative activities are conducted through jump servers Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1401 Multi-factor authentication uses either: something people have and something people… Loosely related Only shares CSF PR.AA-03: related, not a mapping ISM-1504 Multi-factor authentication is used to authenticate human users to their organisation’s online services that process… Loosely related Only shares CSF PR.AA-03: related, not a mapping …and 28 more in the downloads
DORA	Art.9(4)(c)	Protection and prevention	Editorial	Same topic: Access Control (editorial pick) 1 loosely related (not mappings) Art.9(4)(d) Protection and prevention Loosely related Only shares CSF PR.AA-03: related, not a mapping
CPS 234	—	No requirement	No mapping in our data	No mapping in our data (CPS 234 is principles-based and its links are editorial).
Cyber Essentials	CE 4	User Access Control	Editorial	Same topic: Access Control (editorial pick) 1 loosely related (not mappings) CE 2 Secure Configuration Loosely related Only shares CSF PR.AA-05: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.