Access Enforcement

frameworkNIST SP 800-53 Rev 5.2 sectionAC Access Control csf 2.0PR.AA-05 PR.DS-10 PR.IR-01 topicsAccess Control, Zero Trust frameworks7 4 0

Official textEnforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.NIST SP 800-53 Rev 5.2 control statement (public domain)

gap from 800-53 → gap to 800-53 →

Wrong or missing mapping? Report it

Equivalents of AC-3 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	PR.AA-01 PR.AA-03 PR.AA-04 PR.AA-05 PR.IR-01	Identities and credentials for authorized users, services, and hardware are managed by the organization; Users, services, and hardware are authenticated…	Crosswalk	Same topic: Access Control, Zero Trust 1 loosely related (not mappings) PR.DS-10 The confidentiality, integrity, and availability of data-in-use are protected Loosely related Only shares CSF PR.DS-10: related, not a mapping
ISO 27001	A.5.15 A.5.16 A.5.18 A.8.3 A.8.5 A.8.22 A.5.33 A.8.4 A.8.18 A.8.20 A.8.26	Access control; Identity management…	Crosswalk	Same topic: Access Control, Zero Trust NIST SP 800-53 → ISO 27001 mapping 17 loosely related (not mappings) A.5.3 Segregation of duties Loosely related Only shares CSF PR.AA-05, PR.DS-10: related, not a mapping A.5.14 Information transfer Loosely related Only shares CSF PR.AA-05, PR.DS-10: related, not a mapping A.8.2 Privileged access rights Loosely related Only shares CSF PR.AA-05, PR.DS-10: related, not a mapping A.5.1 Policies for information security Loosely related Only shares CSF PR.AA-05: related, not a mapping A.5.10 Acceptable use of information and other associated assets Loosely related Only shares CSF PR.DS-10: related, not a mapping A.5.13 Labelling of information Loosely related Only shares CSF PR.DS-10: related, not a mapping A.5.17 Authentication information Loosely related Only shares CSF PR.AA-05: related, not a mapping A.5.23 Information security for use of cloud services Loosely related Only shares CSF PR.DS-10: related, not a mapping …and 9 more in the downloads
CIS v8.1	CIS 3.3 CIS 5.1 CIS 5.6 CIS 6.7 CIS 6.8 CIS 12.2 CIS 5.2 CIS 5.3 CIS 5.5 CIS 6.1 CIS 6.2 CIS 6.6 CIS 12.5 CIS 12.7 CIS 13.5	Configure Data Access Control Lists; Establish and Maintain an Inventory of Accounts…	Crosswalk	Same topic: Access Control, Zero Trust 24 loosely related (not mappings) CIS 3.12 Segment Data Processing and Storage Based on Sensitivity Loosely related Only shares CSF PR.DS-10, PR.IR-01: related, not a mapping CIS 3.1 Establish and Maintain a Data Management Process Loosely related Only shares CSF PR.DS-10: related, not a mapping CIS 3.4 Enforce Data Retention Loosely related Only shares CSF PR.DS-10: related, not a mapping CIS 3.5 Securely Dispose of Data Loosely related Only shares CSF PR.DS-10: related, not a mapping CIS 3.13 Deploy a Data Loss Prevention Solution Loosely related Only shares CSF PR.DS-10: related, not a mapping CIS 4.4 Implement and Manage a Firewall on Servers Loosely related Only shares CSF PR.IR-01: related, not a mapping CIS 4.5 Implement and Manage a Firewall on End-User Devices Loosely related Only shares CSF PR.IR-01: related, not a mapping CIS 4.9 Configure Trusted DNS Servers on Enterprise Assets Loosely related Only shares CSF PR.IR-01: related, not a mapping …and 16 more in the downloads
SOC 2	CC6.1 CC6.2 CC6.3 CC6.6	Logical access security over information assets; User registration, authorization and removal…	Editorial	Same topic: Access Control, Zero Trust (editorial pick) 4 loosely related (not mappings) CC6.7 Restricting transmission, movement and removal of information Loosely related Only shares CSF PR.AA-05, PR.DS-10: related, not a mapping C1.2 Disposing of confidential information Loosely related Only shares CSF PR.DS-10: related, not a mapping CC6.5 Protection of data when assets are disposed of Loosely related Only shares CSF PR.DS-10: related, not a mapping CC9.2 Managing vendor and business partner risk Loosely related Only shares CSF PR.IR-01: related, not a mapping
PCI DSS	7.2.1 7.2.2 7.2.4 8.2.1 8.3.1	Access control model defined; Access assigned by job function and least privilege…	Crosswalk	Same topic: Access Control, Zero Trust 24 loosely related (not mappings) 1.2.3 Accurate network diagram maintained Loosely related Only shares CSF PR.IR-01: related, not a mapping 1.2.4 Accurate account-data flow diagram maintained Loosely related Only shares CSF PR.IR-01: related, not a mapping 3.2.1 Account data storage minimised, with retention and disposal Loosely related Only shares CSF PR.DS-10: related, not a mapping 3.4.1 PAN masked when displayed Loosely related Only shares CSF PR.DS-10: related, not a mapping 5.2.1 Anti-malware deployed on system components Loosely related Only shares CSF PR.IR-01: related, not a mapping 5.2.2 Anti-malware detects, removes or contains known malware Loosely related Only shares CSF PR.IR-01: related, not a mapping 5.2.3 Systems without anti-malware periodically re-evaluated Loosely related Only shares CSF PR.IR-01: related, not a mapping 5.2.3.1 Re-evaluation frequency set by targeted risk analysis Loosely related Only shares CSF PR.IR-01: related, not a mapping …and 16 more in the downloads
CMMC	AC.L2-3.1.1 AC.L2-3.1.2 SC.L2-3.13.1 SC.L2-3.13.6 SC.L2-3.13.3	Authorized Access Control; Transaction & Function Control…	Crosswalk	Same topic: Access Control, Zero Trust NIST SP 800-171r3 03.01.02 → SP 800-53 31 loosely related (not mappings) AC.L2-3.1.3 Control CUI Flow Loosely related Only shares CSF PR.DS-10, PR.IR-01: related, not a mapping SC.L2-3.13.2 Security Engineering Loosely related Only shares CSF PR.DS-10, PR.IR-01: related, not a mapping SC.L2-3.13.4 Shared Resource Control Loosely related Only shares CSF PR.DS-10, PR.IR-01: related, not a mapping SC.L2-3.13.5 Public-Access System Separation Loosely related Only shares CSF PR.DS-10, PR.IR-01: related, not a mapping AC.L2-3.1.4 Separation of Duties Loosely related Only shares CSF PR.AA-05: related, not a mapping AC.L2-3.1.5 Least Privilege Loosely related Only shares CSF PR.AA-05: related, not a mapping AC.L2-3.1.6 Non-Privileged Account Use Loosely related Only shares CSF PR.AA-05: related, not a mapping AC.L2-3.1.7 Privileged Functions Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 23 more in the downloads
HIPAA	§164.308(a)(4)§164.312(a)§164.312(a)(2)(i)§164.312(d)§164.308(a)(3)§164.308(a)(3)(ii)(A)§164.308(a)(4)(ii)(B)§164.310(b)§164.312(a)(2)(ii)	Information Access Management; Access Control…	Crosswalk	Same topic: Access Control NIST HIPAA → SP 800-53 crosswalk 19 loosely related (not mappings) §164.308(a)(3)(ii)(B) Workforce Clearance Procedure Loosely related Only shares CSF PR.AA-05, PR.DS-10: related, not a mapping §164.308(a)(4)(ii)(A) Isolating Health care Clearinghouse Function Loosely related Only shares CSF PR.AA-05, PR.DS-10: related, not a mapping §164.308(a)(4)(ii)(C) Access Establishment and Modification Loosely related Only shares CSF PR.AA-05, PR.DS-10: related, not a mapping §164.308(a)(1)(ii)(D) Information System Activity Review Loosely related Only shares CSF PR.DS-10: related, not a mapping §164.308(a)(7)(ii)(A) Data Backup Plan Loosely related Only shares CSF PR.DS-10: related, not a mapping §164.308(a)(7)(ii)(B) Disaster Recovery Plan Loosely related Only shares CSF PR.DS-10: related, not a mapping §164.308(b)(1) Business Associate Contracts and Other Arrangements Loosely related Only shares CSF PR.DS-10: related, not a mapping §164.308(b)(4) Written Contract or Other Arrangement Loosely related Only shares CSF PR.DS-10: related, not a mapping …and 11 more in the downloads
GDPR	Art.25(2)Art.32(1)(b)	Data protection by design and by default; Security of processing	Editorial	Same topic: Access Control (editorial pick) 3 loosely related (not mappings) Art.5(1)(e) Principles relating to processing of personal data Loosely related Only shares CSF PR.DS-10: related, not a mapping Art.5(1)(f) Principles relating to processing of personal data Loosely related Only shares CSF PR.DS-10: related, not a mapping Art.28(1) Processor Loosely related Only shares CSF PR.IR-01: related, not a mapping
NIS2	6.8 11.1 11.2 11.5 11.6	Network segmentation; Access control policy…	Crosswalk	Same topic: Zero Trust, Access Control 2 loosely related (not mappings) 6.7 Network security Loosely related Only shares CSF PR.IR-01: related, not a mapping 11.4 Administration systems Loosely related Only shares CSF PR.AA-05: related, not a mapping
Essential Eight	ISM-0445 ISM-1175 ISM-1380 ISM-1387	Privileged human users are assigned a dedicated privileged user account to be used…; Privileged user accounts (excluding those explicitly authorised to access online……	Loosely related	No mapping. Only shares CSF PR.AA-05: related, not a mapping +16 more loosely related (not mappings) ISM-1507 Requests for privileged access to systems and their resources are validated when first… Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1508 Privileged access to systems and their resources is limited to only what is required… Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1509 Privileged access events are centrally logged Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1647 Privileged access to systems and their resources are disabled after 12 months unless… Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 12 more in the downloads
DORA	Art.9(4)(c)	Protection and prevention	Editorial	Same topic: Access Control (editorial pick) 6 loosely related (not mappings) Art.9(2) Protection and prevention Loosely related Only shares CSF PR.DS-10: related, not a mapping Art.9(3)(c) Protection and prevention Loosely related Only shares CSF PR.DS-10: related, not a mapping Art.9(3)(d) Protection and prevention Loosely related Only shares CSF PR.DS-10: related, not a mapping Art.9(4)(b) Protection and prevention Loosely related Only shares CSF PR.IR-01: related, not a mapping Art.28(8) General principles Loosely related Only shares CSF PR.IR-01: related, not a mapping Art.30(2) Key contractual provisions Loosely related Only shares CSF PR.IR-01: related, not a mapping
CPS 234	Para 21	Timely controls commensurate with risk and asset life-cycle	Loosely related	No mapping. Only shares CSF PR.DS-10: related, not a mapping
Cyber Essentials	CE 4	User Access Control	Editorial	Same topic: Access Control (editorial pick) 2 loosely related (not mappings) CE 1 Firewalls Loosely related Only shares CSF PR.IR-01: related, not a mapping CE 2 Secure Configuration Loosely related Only shares CSF PR.AA-05: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.