NIS2 · 11. Access control

Authentication

frameworkNIS2 Implementing Regulation (EU) 2024/2690 section11. Access control csf 2.0PR.AA-03 PR.AA-05 topicsMulti-Factor Auth, Zero Trust frameworks6 4 1

Official text · not licensableTitle from ENISA's guidance: Authentication. See the Annex to Implementing Regulation (EU) 2024/2690 for the legal text.

gap from NIS2 → gap to NIS2 →

Wrong or missing mapping? Report it

Equivalents of 11.6 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	PR.AA-03 PR.AA-04 PR.AA-05 PR.IR-01	Users, services, and hardware are authenticated; Identity assertions are protected, conveyed, and verified…	Crosswalk	Same topic: Multi-Factor Auth, Zero Trust
ISO 27001	A.5.15 A.8.5 A.8.22 A.5.17	Access control; Secure authentication…	Crosswalk	Same topic: Zero Trust, Multi-Factor Auth ENISA NIS2 → ISO 27001 mapping 10 loosely related (not mappings) A.5.16 Identity management Loosely related Only shares CSF PR.AA-03, PR.AA-05: related, not a mapping A.5.18 Access rights Loosely related Only shares CSF PR.AA-03, PR.AA-05: related, not a mapping A.5.1 Policies for information security Loosely related Only shares CSF PR.AA-05: related, not a mapping A.5.3 Segregation of duties Loosely related Only shares CSF PR.AA-05: related, not a mapping A.5.14 Information transfer Loosely related Only shares CSF PR.AA-05: related, not a mapping A.8.2 Privileged access rights Loosely related Only shares CSF PR.AA-05: related, not a mapping A.8.3 Information access restriction Loosely related Only shares CSF PR.AA-05: related, not a mapping A.8.4 Access to source code Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 2 more in the downloads
CIS v8.1	CIS 6.8 CIS 12.2 CIS 6.3 CIS 6.4 CIS 6.5 CIS 12.7 CIS 13.5	Define and Maintain Role-Based Access Control; Establish and Maintain a Secure Network Architecture…	Crosswalk	Same topic: Zero Trust, Multi-Factor Auth 16 loosely related (not mappings) CIS 3.3 Configure Data Access Control Lists Loosely related Only shares CSF PR.AA-05: related, not a mapping CIS 5.1 Establish and Maintain an Inventory of Accounts Loosely related Only shares CSF PR.AA-05: related, not a mapping CIS 4.10 Enforce Automatic Device Lockout on Portable End-User Devices Loosely related Only shares CSF PR.AA-05: related, not a mapping CIS 4.11 Enforce Remote Wipe Capability on Portable End-User Devices Loosely related Only shares CSF PR.AA-05: related, not a mapping CIS 4.12 Separate Enterprise Workspaces on Mobile End-User Devices Loosely related Only shares CSF PR.AA-05: related, not a mapping CIS 5.2 Use Unique Passwords Loosely related Only shares CSF PR.AA-05: related, not a mapping CIS 5.3 Disable Dormant Accounts Loosely related Only shares CSF PR.AA-05: related, not a mapping CIS 5.4 Restrict Administrator Privileges to Dedicated Administrator Accounts Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 8 more in the downloads
SOC 2	CC6.1 CC6.6	Logical access security over information assets; Protection against threats from outside system boundaries	Editorial	Same topic: Multi-Factor Auth, Zero Trust (editorial pick) 3 loosely related (not mappings) CC6.2 User registration, authorization and removal Loosely related Only shares CSF PR.AA-05: related, not a mapping CC6.3 Role-based access, least privilege and segregation of duties Loosely related Only shares CSF PR.AA-05: related, not a mapping CC6.7 Restricting transmission, movement and removal of information Loosely related Only shares CSF PR.AA-05: related, not a mapping
PCI DSS	7.2.1 8.3.1 8.4.1 8.4.2 8.4.3 8.5.1	Access control model defined; User and admin access requires an authentication factor…	Crosswalk	Same topic: Zero Trust, Multi-Factor Auth 19 loosely related (not mappings) 2.2.2 Vendor default accounts managed or removed Loosely related Only shares CSF PR.AA-03: related, not a mapping 2.3.1 Wireless vendor defaults changed Loosely related Only shares CSF PR.AA-03: related, not a mapping 3.5.1.3 Disk encryption access managed separately from OS access Loosely related Only shares CSF PR.AA-03: related, not a mapping 7.1.1 Access restriction policies documented and kept current Loosely related Only shares CSF PR.AA-05: related, not a mapping 7.2.2 Access assigned by job function and least privilege Loosely related Only shares CSF PR.AA-05: related, not a mapping 7.2.4 User accounts and privileges reviewed every six months Loosely related Only shares CSF PR.AA-05: related, not a mapping 7.2.5.1 System and application account access periodically reviewed Loosely related Only shares CSF PR.AA-05: related, not a mapping 8.1.1 Identification and authentication policies documented Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 11 more in the downloads
CMMC	AC.L2-3.1.1 IA.L2-3.5.3 SC.L2-3.13.1 SC.L2-3.13.6	Authorized Access Control; Multifactor Authentication…	Crosswalk	Same topic: Zero Trust, Multi-Factor Auth 28 loosely related (not mappings) AC.L2-3.1.2 Transaction & Function Control Loosely related Only shares CSF PR.AA-05: related, not a mapping AC.L2-3.1.4 Separation of Duties Loosely related Only shares CSF PR.AA-05: related, not a mapping AC.L2-3.1.5 Least Privilege Loosely related Only shares CSF PR.AA-05: related, not a mapping AC.L2-3.1.6 Non-Privileged Account Use Loosely related Only shares CSF PR.AA-05: related, not a mapping AC.L2-3.1.7 Privileged Functions Loosely related Only shares CSF PR.AA-05: related, not a mapping AC.L2-3.1.8 Unsuccessful Logon Attempts Loosely related Only shares CSF PR.AA-03: related, not a mapping AC.L2-3.1.11 Session Termination Loosely related Only shares CSF PR.AA-03: related, not a mapping AC.L2-3.1.12 Control Remote Access Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 20 more in the downloads
800-53	AC-3 AC-4 AC-6 IA-2 IA-2(1)IA-2(2)	Access Enforcement; Information Flow Enforcement…	Crosswalk	Same topic: Zero Trust, Multi-Factor Auth 22 loosely related (not mappings) AC-2 Account Management Loosely related Only shares CSF PR.AA-05: related, not a mapping AC-5 Separation of Duties Loosely related Only shares CSF PR.AA-05: related, not a mapping AC-7 Unsuccessful Logon Attempts Loosely related Only shares CSF PR.AA-03: related, not a mapping AC-10 Concurrent Session Control Loosely related Only shares CSF PR.AA-05: related, not a mapping AC-12 Session Termination Loosely related Only shares CSF PR.AA-03: related, not a mapping AC-16 Security and Privacy Attributes Loosely related Only shares CSF PR.AA-05: related, not a mapping AC-17 Remote Access Loosely related Only shares CSF PR.AA-05: related, not a mapping AC-18 Wireless Access Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 14 more in the downloads
HIPAA	§164.310(b)§164.312(a)(2)(i)§164.312(d)§164.308(a)(3)	Workstation Use; Unique User Identification…	Loosely related	No mapping. Only shares CSF PR.AA-03, PR.AA-05: related, not a mapping +12 more loosely related (not mappings) §164.308(a)(3)(ii)(A) Authorization and/or Supervision Loosely related Only shares CSF PR.AA-05: related, not a mapping §164.308(a)(3)(ii)(B) Workforce Clearance Procedure Loosely related Only shares CSF PR.AA-05: related, not a mapping §164.308(a)(4) Information Access Management Loosely related Only shares CSF PR.AA-05: related, not a mapping §164.308(a)(4)(ii)(A) Isolating Health care Clearinghouse Function Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 8 more in the downloads
GDPR	Art.25(2)Art.32(1)(b)	Data protection by design and by default; Security of processing	Loosely related	No mapping. Only shares CSF PR.AA-05: related, not a mapping
Essential Eight	ISM-0974 ISM-1173 ISM-1401 ISM-1504 ISM-1679 ISM-1872	Multi-factor authentication is used to authenticate unprivileged human users of systems; Multi-factor authentication is used to authenticate privileged human users of systems…	Editorial	Same topic: Multi-Factor Auth (editorial pick) 30 loosely related (not mappings) ISM-0445 Privileged human users are assigned a dedicated privileged user account to be used… Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1175 Privileged user accounts (excluding those explicitly authorised to access online… Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1380 Privileged human users use separate privileged and unprivileged operating environments Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1387 Administrative activities are conducted through jump servers Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1505 Multi-factor authentication is used to authenticate human users of data repositories Loosely related Only shares CSF PR.AA-03: related, not a mapping ISM-1507 Requests for privileged access to systems and their resources are validated when first… Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1508 Privileged access to systems and their resources is limited to only what is required… Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1509 Privileged access events are centrally logged Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 22 more in the downloads
DORA	Art.9(4)(d)	Protection and prevention	Editorial	Same topic: Multi-Factor Auth (editorial pick) 1 loosely related (not mappings) Art.9(4)(c) Protection and prevention Loosely related Only shares CSF PR.AA-05: related, not a mapping
CPS 234	—	No requirement	No mapping in our data	No mapping in our data (CPS 234 is principles-based and its links are editorial).
Cyber Essentials	CE 4	User Access Control	Editorial	Same topic: Multi-Factor Auth (editorial pick) 1 loosely related (not mappings) CE 2 Secure Configuration Loosely related Only shares CSF PR.AA-05: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.