Security and Privacy Attributes

frameworkNIST SP 800-53 Rev 5.2 sectionAC Access Control csf 2.0PR.AA-05 topics— frameworks1 0 1

Official texta. Provide the means to associate [Assignment: organization-defined organization-defined types of security and privacy attributes] with [Assignment: organization-defined organization-defined security and privacy attribute values] for information in storage, in process, and/or in transmission;
b. Ensure that the attribute associations are made and retained with the information;
c. Establish the following permitted security and privacy attributes from the attributes defined in [AC-16a](#ac-16_smt.a) for [Assignment: organization-defined organization-defined systems]: [Assignment: organization-defined organization-defined security and privacy attributes];
d. Determine the following permitted attribute values or ranges for each of the established attributes: [Assignment: organization-defined attribute values or ranges];
e. Audit changes to attributes; and
f. Review [Assignment: organization-defined organization-defined security and privacy attributes] for applicability [Assignment: organization-defined organization-defined frequency].NIST SP 800-53 Rev 5.2 control statement (public domain)

gap from 800-53 → gap to 800-53 →

Wrong or missing mapping? Report it

Equivalents of AC-16 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	PR.AA-05	Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties	Loosely related	No mapping. Only shares CSF PR.AA-05: related, not a mapping
ISO 27001	A.5.1 A.5.3 A.5.14 A.5.15	Policies for information security; Segregation of duties…	Loosely related	No mapping. Only shares CSF PR.AA-05: related, not a mapping +9 more loosely related (not mappings) A.5.16 Identity management Loosely related Only shares CSF PR.AA-05: related, not a mapping A.5.17 Authentication information Loosely related Only shares CSF PR.AA-05: related, not a mapping A.5.18 Access rights Loosely related Only shares CSF PR.AA-05: related, not a mapping A.8.2 Privileged access rights Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 5 more in the downloads
CIS v8.1	CIS 3.3 CIS 5.1 CIS 6.8 CIS 4.10	Configure Data Access Control Lists; Establish and Maintain an Inventory of Accounts…	Loosely related	No mapping. Only shares CSF PR.AA-05: related, not a mapping +13 more loosely related (not mappings) CIS 4.11 Enforce Remote Wipe Capability on Portable End-User Devices Loosely related Only shares CSF PR.AA-05: related, not a mapping CIS 4.12 Separate Enterprise Workspaces on Mobile End-User Devices Loosely related Only shares CSF PR.AA-05: related, not a mapping CIS 5.2 Use Unique Passwords Loosely related Only shares CSF PR.AA-05: related, not a mapping CIS 5.3 Disable Dormant Accounts Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 9 more in the downloads
SOC 2	CC6.1 CC6.2 CC6.3 CC6.6	Logical access security over information assets; User registration, authorization and removal…	Loosely related	No mapping. Only shares CSF PR.AA-05: related, not a mapping +1 more loosely related (not mappings) CC6.7 Restricting transmission, movement and removal of information Loosely related Only shares CSF PR.AA-05: related, not a mapping
PCI DSS	7.1.1 7.2.1 7.2.2 7.2.4	Access restriction policies documented and kept current; Access control model defined…	Loosely related	No mapping. Only shares CSF PR.AA-05: related, not a mapping +4 more loosely related (not mappings) 7.2.5.1 System and application account access periodically reviewed Loosely related Only shares CSF PR.AA-05: related, not a mapping 8.1.1 Identification and authentication policies documented Loosely related Only shares CSF PR.AA-05: related, not a mapping 8.2.6 Inactive user accounts disabled within 90 days Loosely related Only shares CSF PR.AA-05: related, not a mapping 12.1.3 Security roles and responsibilities defined Loosely related Only shares CSF PR.AA-05: related, not a mapping
CMMC	AC.L2-3.1.1 AC.L2-3.1.2 AC.L2-3.1.4 AC.L2-3.1.5	Authorized Access Control; Transaction & Function Control…	Loosely related	No mapping. Only shares CSF PR.AA-05: related, not a mapping +16 more loosely related (not mappings) AC.L2-3.1.6 Non-Privileged Account Use Loosely related Only shares CSF PR.AA-05: related, not a mapping AC.L2-3.1.7 Privileged Functions Loosely related Only shares CSF PR.AA-05: related, not a mapping AC.L2-3.1.12 Control Remote Access Loosely related Only shares CSF PR.AA-05: related, not a mapping AC.L2-3.1.13 Remote Access Confidentiality Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 12 more in the downloads
HIPAA	§164.310(b)	Workstation Use	Crosswalk	NIST HIPAA → SP 800-53 crosswalk 14 loosely related (not mappings) §164.308(a)(3) Workforce Security Loosely related Only shares CSF PR.AA-05: related, not a mapping §164.308(a)(3)(ii)(A) Authorization and/or Supervision Loosely related Only shares CSF PR.AA-05: related, not a mapping §164.308(a)(3)(ii)(B) Workforce Clearance Procedure Loosely related Only shares CSF PR.AA-05: related, not a mapping §164.308(a)(4) Information Access Management Loosely related Only shares CSF PR.AA-05: related, not a mapping §164.308(a)(4)(ii)(A) Isolating Health care Clearinghouse Function Loosely related Only shares CSF PR.AA-05: related, not a mapping §164.308(a)(4)(ii)(B) Access Authorization Loosely related Only shares CSF PR.AA-05: related, not a mapping §164.308(a)(4)(ii)(C) Access Establishment and Modification Loosely related Only shares CSF PR.AA-05: related, not a mapping §164.312(a) Access Control Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 6 more in the downloads
GDPR	Art.25(2)Art.32(1)(b)	Data protection by design and by default; Security of processing	Loosely related	No mapping. Only shares CSF PR.AA-05: related, not a mapping
NIS2	11.1 11.2 11.5 11.6	Access control policy; Management of access rights…	Loosely related	No mapping. Only shares CSF PR.AA-05: related, not a mapping +1 more loosely related (not mappings) 11.4 Administration systems Loosely related Only shares CSF PR.AA-05: related, not a mapping
Essential Eight	ISM-0445 ISM-1175 ISM-1380 ISM-1387	Privileged human users are assigned a dedicated privileged user account to be used…; Privileged user accounts (excluding those explicitly authorised to access online……	Loosely related	No mapping. Only shares CSF PR.AA-05: related, not a mapping +16 more loosely related (not mappings) ISM-1507 Requests for privileged access to systems and their resources are validated when first… Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1508 Privileged access to systems and their resources is limited to only what is required… Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1509 Privileged access events are centrally logged Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1647 Privileged access to systems and their resources are disabled after 12 months unless… Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 12 more in the downloads
DORA	Art.9(4)(c)	Protection and prevention	Loosely related	No mapping. Only shares CSF PR.AA-05: related, not a mapping
CPS 234	—	No requirement	No mapping in our data	No mapping in our data (CPS 234 is principles-based and its links are editorial).
Cyber Essentials	CE 2 CE 4	Secure Configuration; User Access Control	Loosely related	No mapping. Only shares CSF PR.AA-05: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.