SOC 2 · CC6 Logical and physical access
CC6.1
Logical access security over information assets
frameworkSOC 2 (Trust Services Criteria)
sectionCC6 Logical and physical access
csf 2.0ID.AM-01 ID.AM-02 ID.AM-04 ID.AM-08 PR.AA-01 PR.AA-03 PR.AA-05 PR.DS-01 PR.DS-02
topicsAsset Management, Access Control, Multi-Factor Auth, Encryption
frameworks0 13 0
Official text · not licensableSummary (ControlMapping's wording): Logical access security over information assets. The criterion text is AICPA's copyright.
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | ID.AM-01ID.AM-02ID.AM-04ID.AM-08PR.AA-01PR.AA-03PR.AA-05PR.DS-01PR.DS-02 | Inventories of hardware managed by the organization are maintained; Inventories of software, services, and systems managed by the organization are maintained… | Editorial | Same topic: Asset Management, Access Control, Multi-Factor Auth, Encryption (editorial pick) |
| ISO 27001 | A.5.9A.5.11A.5.15A.5.16A.5.18A.7.14A.8.3A.8.5A.8.24 | Inventory of information and other associated assets; Return of assets… | Editorial | Same topic: Asset Management, Access Control, Multi-Factor Auth, Encryption (editorial pick)36 loosely related (not mappings)A.8.2 Privileged access rights Only shares CSF PR.AA-01, PR.AA-05, PR.DS-01, PR.DS-02: related, not a mapping A.5.13 Labelling of information Only shares CSF ID.AM-08, PR.DS-01, PR.DS-02: related, not a mapping A.5.10 Acceptable use of information and other associated assets Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping …and 28 more in the downloads |
| CIS v8.1 | CIS 1.1CIS 1.2CIS 1.3CIS 1.4CIS 1.5CIS 2.1CIS 2.3CIS 2.4CIS 3.3CIS 3.6CIS 3.9CIS 3.10CIS 3.11CIS 5.1CIS 5.2CIS 5.3CIS 5.5CIS 5.6CIS 6.1CIS 6.2CIS 6.3CIS 6.4CIS 6.5CIS 6.6CIS 6.7CIS 6.8CIS 12.5CIS 16.4 | Establish and Maintain Detailed Enterprise Asset Inventory; Address Unauthorized Assets… | Editorial | Same topic: Asset Management, Access Control, Encryption, Multi-Factor Auth (editorial pick)20 loosely related (not mappings)CIS 3.5 Securely Dispose of Data Only shares CSF ID.AM-08, PR.DS-01, PR.DS-02: related, not a mapping CIS 3.1 Establish and Maintain a Data Management Process Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping CIS 3.12 Segment Data Processing and Storage Based on Sensitivity Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping CIS 3.13 Deploy a Data Loss Prevention Solution Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping CIS 12.7 Ensure Remote Devices Utilize a VPN and are Connecting to an Enterprise's AAA Infrastructure Only shares CSF PR.AA-03, PR.AA-05: related, not a mapping CIS 13.5 Manage Access Control for Remote Assets Only shares CSF PR.AA-03, PR.AA-05: related, not a mapping CIS 4.10 Enforce Automatic Device Lockout on Portable End-User Devices Only shares CSF PR.AA-05: related, not a mapping …and 12 more in the downloads |
| PCI DSS | 3.5.13.6.13.7.13.7.44.2.14.2.1.16.3.27.2.17.2.27.2.48.2.18.4.18.4.28.4.38.5.112.5.1 | PAN rendered unreadable wherever stored; Procedures protect keys that secure stored account data… | Editorial | Same topic: Encryption, Asset Management, Access Control, Multi-Factor Auth (editorial pick)46 loosely related (not mappings)3.4.2 PAN copying prevented over remote-access technologies Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping 3.5.1.3 Disk encryption access managed separately from OS access Only shares CSF PR.AA-03, PR.DS-01: related, not a mapping 3.6.1.1 Service providers document their cryptographic architecture Only shares CSF PR.AA-01, PR.DS-01: related, not a mapping 3.6.1.2 Secret and private keys stored in approved forms Only shares CSF PR.AA-01, PR.DS-01: related, not a mapping 3.6.1.3 Cleartext key components accessible to fewest custodians Only shares CSF PR.AA-01, PR.DS-01: related, not a mapping 3.6.1.4 Keys stored in the fewest possible locations Only shares CSF PR.AA-01, PR.DS-01: related, not a mapping 6.2.4 Coding techniques prevent common software attacks Only shares CSF ID.AM-08, PR.AA-03: related, not a mapping …and 38 more in the downloads |
| CMMC | AC.L2-3.1.1AC.L2-3.1.2AC.L2-3.1.13AC.L2-3.1.19CM.L2-3.4.1IA.L2-3.5.3MP.L2-3.8.6SC.L2-3.13.8SC.L2-3.13.10SC.L2-3.13.11SC.L2-3.13.16 | Authorized Access Control; Transaction & Function Control… | Editorial | Same topic: Access Control, Encryption, Asset Management, Multi-Factor Auth (editorial pick)43 loosely related (not mappings)SC.L2-3.13.2 Security Engineering Only shares CSF ID.AM-08, PR.DS-01, PR.DS-02: related, not a mapping IA.L2-3.5.4 Replay-Resistant Authentication Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping …and 35 more in the downloads |
| 800-53 | AC-2AC-3CM-8IA-2(1)IA-2(2)PM-5SC-8SC-12SC-13SC-28 | Account Management; Access Enforcement… | Editorial | Same topic: Access Control, Asset Management, Multi-Factor Auth, Encryption (editorial pick)62 loosely related (not mappings)IA-2 Identification and Authentication (Organizational Users) Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping IA-3 Device Identification and Authentication Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping IA-8 Identification and Authentication (Non-organizational Users) Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping IA-9 Service Identification and Authentication Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping …and 54 more in the downloads |
| HIPAA | §164.308(a)(4)§164.310(d)§164.310(d)(2)(iii)§164.312(a)§164.312(a)(2)(i)§164.312(a)(2)(iv)§164.312(d)§164.312(e)(2)(ii) | Information Access Management; Device and Media Controls… | Editorial | Same topic: Access Control, Asset Management, Encryption (editorial pick)36 loosely related (not mappings)§164.308(b)(4) Written Contract or Other Arrangement Only shares CSF ID.AM-02, ID.AM-04, ID.AM-08, PR.DS-01…: related, not a mapping §164.308(b)(1) Business Associate Contracts and Other Arrangements Only shares CSF ID.AM-02, ID.AM-04, PR.DS-01, PR.DS-02: related, not a mapping §164.314(a)(2)(ii) Other Arrangements Only shares CSF ID.AM-02, ID.AM-04, PR.DS-01, PR.DS-02: related, not a mapping §164.308(a)(4)(ii)(A) Isolating Health care Clearinghouse Function Only shares CSF PR.AA-05, PR.DS-01, PR.DS-02: related, not a mapping §164.314(a) Business Associate Contracts or Other Arrangements Only shares CSF ID.AM-02, ID.AM-04, ID.AM-08: related, not a mapping §164.314(a)(2)(i) Business Associate Contracts Only shares CSF ID.AM-02, ID.AM-04, ID.AM-08: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Only shares CSF ID.AM-02, ID.AM-04, ID.AM-08: related, not a mapping …and 28 more in the downloads |
| GDPR | Art.25(2)Art.30(1)Art.32(1)(a)Art.32(1)(b)Art.34(3)(a) | Data protection by design and by default; Records of processing activities… | Editorial | Same topic: Access Control, Asset Management, Encryption (editorial pick)3 loosely related (not mappings)Art.5(1)(e) Principles relating to processing of personal data Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping Art.5(1)(f) Principles relating to processing of personal data Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping |
| NIS2 | 9.111.111.211.511.611.712.4 | Cryptography; Access control policy… | Editorial | Same topic: Encryption, Access Control, Multi-Factor Auth, Asset Management (editorial pick) |
| Essential Eight | ISM-0974ISM-1173ISM-1401ISM-1504ISM-1679ISM-1807ISM-1872 | Multi-factor authentication is used to authenticate unprivileged human users of systems; Multi-factor authentication is used to authenticate privileged human users of systems… | Editorial | Same topic: Multi-Factor Auth, Asset Management (editorial pick)31 loosely related (not mappings)ISM-0445 Privileged human users are assigned a dedicated privileged user account to be used… Only shares CSF PR.AA-05: related, not a mapping ISM-1175 Privileged user accounts (excluding those explicitly authorised to access online… Only shares CSF PR.AA-05: related, not a mapping ISM-1380 Privileged human users use separate privileged and unprivileged operating environments Only shares CSF PR.AA-05: related, not a mapping ISM-1387 Administrative activities are conducted through jump servers Only shares CSF PR.AA-05: related, not a mapping ISM-1488 Microsoft Office macros in files originating from the internet are blocked Only shares CSF PR.DS-02: related, not a mapping ISM-1505 Multi-factor authentication is used to authenticate human users of data repositories Only shares CSF PR.AA-03: related, not a mapping ISM-1507 Requests for privileged access to systems and their resources are validated when first… Only shares CSF PR.AA-05: related, not a mapping ISM-1508 Privileged access to systems and their resources is limited to only what is required… Only shares CSF PR.AA-05: related, not a mapping …and 23 more in the downloads |
| DORA | Art.8(1)Art.8(4)Art.8(6)Art.9(3)(a)Art.9(4)(c)Art.9(4)(d) | Identification; Identification… | Editorial | Same topic: Asset Management, Encryption, Access Control, Multi-Factor Auth (editorial pick)5 loosely related (not mappings) |
| CPS 234 | Para 20 | Classify information assets by criticality and sensitivity | Editorial | Same topic: Asset Management (editorial pick)1 loosely related (not mappings)Para 21 Timely controls commensurate with risk and asset life-cycle Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping |
| Cyber Essentials | CE 3CE 4 | Security Update Management; User Access Control | Editorial | Same topic: Asset Management, Access Control, Multi-Factor Auth (editorial pick)1 loosely related (not mappings) |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.