NIS2 · 11. Access control

Identification

frameworkNIS2 Implementing Regulation (EU) 2024/2690 section11. Access control csf 2.0PR.AA-01 PR.AA-05 PR.AA-06 topicsAccess Control frameworks7 4 1

Official text · not licensableTitle from ENISA's guidance: Identification. See the Annex to Implementing Regulation (EU) 2024/2690 for the legal text.

gap from NIS2 → gap to NIS2 →

Wrong or missing mapping? Report it

Equivalents of 11.5 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	PR.AA-01 PR.AA-05	Identities and credentials for authorized users, services, and hardware are managed by the organization; Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties	Crosswalk	Same topic: Access Control 1 loosely related (not mappings) PR.AA-06 Physical access to assets is managed, monitored, and enforced commensurate with risk Loosely related Only shares CSF PR.AA-06: related, not a mapping
ISO 27001	A.5.15 A.5.16 A.5.18 A.8.3	Access control; Identity management…	Crosswalk	Same topic: Access Control 14 loosely related (not mappings) A.8.2 Privileged access rights Loosely related Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping A.8.5 Secure authentication Loosely related Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping A.5.1 Policies for information security Loosely related Only shares CSF PR.AA-05: related, not a mapping A.5.3 Segregation of duties Loosely related Only shares CSF PR.AA-05: related, not a mapping A.5.14 Information transfer Loosely related Only shares CSF PR.AA-05: related, not a mapping A.5.17 Authentication information Loosely related Only shares CSF PR.AA-05: related, not a mapping A.7.1 Physical security perimeters Loosely related Only shares CSF PR.AA-06: related, not a mapping A.7.2 Physical entry Loosely related Only shares CSF PR.AA-06: related, not a mapping …and 6 more in the downloads
CIS v8.1	CIS 3.3 CIS 5.1 CIS 5.6 CIS 6.7 CIS 6.8 CIS 5.2 CIS 5.3 CIS 5.5 CIS 6.1 CIS 6.2 CIS 6.6 CIS 12.5	Configure Data Access Control Lists; Establish and Maintain an Inventory of Accounts…	Crosswalk	Same topic: Access Control 7 loosely related (not mappings) CIS 4.10 Enforce Automatic Device Lockout on Portable End-User Devices Loosely related Only shares CSF PR.AA-05: related, not a mapping CIS 4.11 Enforce Remote Wipe Capability on Portable End-User Devices Loosely related Only shares CSF PR.AA-05: related, not a mapping CIS 4.12 Separate Enterprise Workspaces on Mobile End-User Devices Loosely related Only shares CSF PR.AA-05: related, not a mapping CIS 5.4 Restrict Administrator Privileges to Dedicated Administrator Accounts Loosely related Only shares CSF PR.AA-05: related, not a mapping CIS 12.7 Ensure Remote Devices Utilize a VPN and are Connecting to an Enterprise's AAA Infrastructure Loosely related Only shares CSF PR.AA-05: related, not a mapping CIS 12.8 Establish and Maintain Dedicated Computing Resources for All Administrative Work Loosely related Only shares CSF PR.AA-05: related, not a mapping CIS 13.5 Manage Access Control for Remote Assets Loosely related Only shares CSF PR.AA-05: related, not a mapping
SOC 2	CC6.1 CC6.2 CC6.3	Logical access security over information assets; User registration, authorization and removal…	Editorial	Same topic: Access Control (editorial pick) 3 loosely related (not mappings) CC6.4 Physical access restrictions Loosely related Only shares CSF PR.AA-06: related, not a mapping CC6.6 Protection against threats from outside system boundaries Loosely related Only shares CSF PR.AA-05: related, not a mapping CC6.7 Restricting transmission, movement and removal of information Loosely related Only shares CSF PR.AA-05: related, not a mapping
PCI DSS	7.2.1 7.2.2 7.2.4 8.2.1	Access control model defined; Access assigned by job function and least privilege…	Crosswalk	Same topic: Access Control 22 loosely related (not mappings) 3.6.1 Procedures protect keys that secure stored account data Loosely related Only shares CSF PR.AA-01: related, not a mapping 3.6.1.1 Service providers document their cryptographic architecture Loosely related Only shares CSF PR.AA-01: related, not a mapping 3.6.1.2 Secret and private keys stored in approved forms Loosely related Only shares CSF PR.AA-01: related, not a mapping 3.6.1.3 Cleartext key components accessible to fewest custodians Loosely related Only shares CSF PR.AA-01: related, not a mapping 3.6.1.4 Keys stored in the fewest possible locations Loosely related Only shares CSF PR.AA-01: related, not a mapping 7.1.1 Access restriction policies documented and kept current Loosely related Only shares CSF PR.AA-05: related, not a mapping 7.2.5.1 System and application account access periodically reviewed Loosely related Only shares CSF PR.AA-05: related, not a mapping 8.1.1 Identification and authentication policies documented Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 14 more in the downloads
CMMC	AC.L2-3.1.1 AC.L2-3.1.2	Authorized Access Control; Transaction & Function Control	Crosswalk	Same topic: Access Control 35 loosely related (not mappings) SC.L2-3.13.3 Role Separation Loosely related Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping AC.L2-3.1.4 Separation of Duties Loosely related Only shares CSF PR.AA-05: related, not a mapping AC.L2-3.1.5 Least Privilege Loosely related Only shares CSF PR.AA-05: related, not a mapping AC.L2-3.1.6 Non-Privileged Account Use Loosely related Only shares CSF PR.AA-05: related, not a mapping AC.L2-3.1.7 Privileged Functions Loosely related Only shares CSF PR.AA-05: related, not a mapping AC.L2-3.1.12 Control Remote Access Loosely related Only shares CSF PR.AA-05: related, not a mapping AC.L2-3.1.13 Remote Access Confidentiality Loosely related Only shares CSF PR.AA-05: related, not a mapping AC.L2-3.1.14 Remote Access Routing Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 27 more in the downloads
800-53	AC-2 AC-3	Account Management; Access Enforcement	Crosswalk	Same topic: Access Control 32 loosely related (not mappings) AC-5 Separation of Duties Loosely related Only shares CSF PR.AA-05: related, not a mapping AC-6 Least Privilege Loosely related Only shares CSF PR.AA-05: related, not a mapping AC-10 Concurrent Session Control Loosely related Only shares CSF PR.AA-05: related, not a mapping AC-14 Permitted Actions Without Identification or Authentication Loosely related Only shares CSF PR.AA-01: related, not a mapping AC-16 Security and Privacy Attributes Loosely related Only shares CSF PR.AA-05: related, not a mapping AC-17 Remote Access Loosely related Only shares CSF PR.AA-05: related, not a mapping AC-18 Wireless Access Loosely related Only shares CSF PR.AA-05: related, not a mapping AC-19 Access Control for Mobile Devices Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 24 more in the downloads
HIPAA	§164.308(a)(4)§164.312(a)§164.312(a)(2)(i)§164.312(d)	Information Access Management; Access Control…	Crosswalk	Same topic: Access Control 17 loosely related (not mappings) §164.308(a)(3) Workforce Security Loosely related Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping §164.308(a)(3)(ii)(A) Authorization and/or Supervision Loosely related Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping §164.308(a)(3)(ii)(B) Workforce Clearance Procedure Loosely related Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping §164.308(a)(4)(ii)(B) Access Authorization Loosely related Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping §164.308(a)(4)(ii)(C) Access Establishment and Modification Loosely related Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping §164.310(b) Workstation Use Loosely related Only shares CSF PR.AA-05, PR.AA-06: related, not a mapping §164.310(d) Device and Media Controls Loosely related Only shares CSF PR.AA-05, PR.AA-06: related, not a mapping §164.312(a)(2)(ii) Emergency Access Procedure Loosely related Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping …and 9 more in the downloads
GDPR	Art.25(2)Art.32(1)(b)	Data protection by design and by default; Security of processing	Editorial	Same topic: Access Control (editorial pick)
Essential Eight	ISM-0445 ISM-1175 ISM-1380 ISM-1387	Privileged human users are assigned a dedicated privileged user account to be used…; Privileged user accounts (excluding those explicitly authorised to access online……	Loosely related	No mapping. Only shares CSF PR.AA-05: related, not a mapping +16 more loosely related (not mappings) ISM-1507 Requests for privileged access to systems and their resources are validated when first… Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1508 Privileged access to systems and their resources is limited to only what is required… Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1509 Privileged access events are centrally logged Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1647 Privileged access to systems and their resources are disabled after 12 months unless… Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 12 more in the downloads
DORA	Art.9(4)(c)	Protection and prevention	Editorial	Same topic: Access Control (editorial pick) 1 loosely related (not mappings) Art.6(2) ICT risk management framework Loosely related Only shares CSF PR.AA-06: related, not a mapping
CPS 234	—	No requirement	No mapping in our data	No mapping in our data (CPS 234 is principles-based and its links are editorial).
Cyber Essentials	CE 4	User Access Control	Editorial	Same topic: Access Control (editorial pick) 1 loosely related (not mappings) CE 2 Secure Configuration Loosely related Only shares CSF PR.AA-05: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.