Kontrol Akses
Kelola identitas dan akses ke aset fisik maupun logis.
Kontrol Akses didefinisikan oleh hasil-hasil NIST CSF 2.0 PR.AA-01 (Identities and credentials for authorized users, services, and hardware are managed by the organization); PR.AA-05 (Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties). Crosswalk Dipetakan melalui crosswalk yang dipublikasikan dalam ISO 27001, CIS v8.1, PCI DSS, CMMC, 800-53, HIPAA dan NIS2. Editorial Dipetakan secara editorial dalam SOC 2, GDPR, DORA dan Cyber Essentials. Tidak ada pemetaan dalam data kami Tidak ada pemetaan dalam data kami untuk Essential Eight dan CPS 234.
| Kerangka kerja | Persyaratan | Judul | Tautan | Sumber / alasan |
|---|---|---|---|---|
| NIST CSF 2.0 | PR.AA-01PR.AA-05 | Identities and credentials for authorized users, services, and hardware are managed by the organization; Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties | Definisi topik | PR.AA-01 PR.AA-05 |
| ISO 27001 | A.5.15A.5.16A.5.18A.8.3 | Access control; Identity management; Access rights… | Crosswalk | A.5.15: via PR.AA-01; PR.AA-05; NIST 800-53 map: AC-3 A.5.16: via PR.AA-01; PR.AA-05; NIST 800-53 map: AC-2 A.5.18: via PR.AA-01; PR.AA-05; NIST 800-53 map: AC-2 A.8.3: via PR.AA-05; NIST 800-53 map: AC-3 |
| CIS v8.1 | CIS 5.1CIS 6.1CIS 6.2CIS 6.7CIS 6.8CIS 3.3CIS 5.2CIS 5.3CIS 5.5CIS 5.6CIS 6.6CIS 12.5 | Establish and Maintain an Inventory of Accounts; Establish an Access Granting Process; Establish an Access Revoking Process… | Crosswalk | CIS 5.1: via PR.AA-01; PR.AA-05 CIS 6.1: Access granting process: the core CIS access-control safeguard; not in CIS's own crosswalk to CSF 2.0, which covers 49 of 153 safeguards. CIS 6.2: Access revoking process; not in CIS's own crosswalk to CSF 2.0, which covers 49 of 153 safeguards. CIS 6.7: via PR.AA-01 CIS 6.8: via PR.AA-05 CIS 3.3: via PR.AA-05 CIS 5.2: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): unique passwords for every account. CIS 5.3: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): disable dormant accounts. CIS 5.5: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): an inventory of service accounts. CIS 5.6: via PR.AA-01 CIS 6.6: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): an inventory of authentication and authorisation systems. CIS 12.5: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): centralised network authentication, authorisation and auditing (AAA). |
| SOC 2 | CC6.1CC6.2CC6.3 | Logical access security over information assets; User registration, authorization and removal; Role-based access, least privilege and segregation of duties | Editorial | AICPA's TSC mappings are not openly licensed; ControlMapping editorial mapping (criterion summaries are ours, not AICPA text). |
| PCI DSS | 7.2.17.2.27.2.48.2.1 | Access control model defined; Access assigned by job function and least privilege; User accounts and privileges reviewed every six months… | Crosswalk | 7.2.1: via PR.AA-05 7.2.2: via PR.AA-05 7.2.4: via PR.AA-05 8.2.1: via PR.AA-01 |
| CMMC | AC.L2-3.1.1AC.L2-3.1.2 | Authorized Access Control; Transaction & Function Control | Crosswalk | AC.L2-3.1.1: via 800-171r3 03.01.01 ↔ PR.AA-01, PR.AA-05 → AC-2; 800-171r2 Appendix D → AC-2, AC-3 AC.L2-3.1.2: via 800-171r3 03.01.02 ↔ PR.AA-05 → AC-3; 800-171r2 Appendix D → AC-2, AC-3 |
| 800-53 | AC-2AC-3 | Account Management; Access Enforcement | Crosswalk | AC-2: via PR.AA-01; PR.AA-05 AC-3: via PR.AA-05 |
| HIPAA | §164.308(a)(4)§164.312(a)§164.312(a)(2)(i)§164.312(d) | Information Access Management; Access Control; Unique User Identification… | Crosswalk | §164.308(a)(4): via NIST HIPAA map: AC-2 §164.312(a): via NIST HIPAA map: AC-3 §164.312(a)(2)(i): via NIST HIPAA map: AC-2, AC-3 §164.312(d): Person or entity authentication: verify that whoever seeks access to ePHI is who they claim. It requires authentication, not specifically multi-factor. |
| GDPR | Art.25(2)Art.32(1)(b) | Data protection by design and by default; Security of processing | Editorial | No official crosswalk exists for GDPR; ControlMapping editorial mapping. |
| NIS2 | 11.111.211.5 | Access control policy; Management of access rights; Identification | Crosswalk | 11.1: via PR.AA-05; ENISA ISO map: A.5.15, A.8.3 11.2: via PR.AA-05; ENISA ISO map: A.5.18 11.5: via PR.AA-01; PR.AA-05; ENISA ISO map: A.5.16 |
| Essential Eight | — | Tidak ada persyaratan | Tidak ada pemetaan dalam data kami | Tidak ada persyaratan Essential Eight yang dipetakan ke topik ini dalam data kami. |
| DORA | Art.9(4)(c) | Protection and prevention | Editorial | Art.9(4)(c): Limit physical and logical access to what legitimate, approved functions require, with sound administration of access rights. |
| CPS 234 | — | Tidak ada persyaratan | Tidak ada pemetaan dalam data kami | Tidak ada persyaratan CPS 234 yang dipetakan ke topik ini dalam data kami. |
| Cyber Essentials | CE 4 | User Access Control | Editorial | CE 4: Approved accounts only, unique credentials, only the access each role needs, and accounts removed when no longer needed. |
Definisi topik Hasil CSF 2.0 yang mendefinisikan topik ini · Crosswalk setidaknya satu pilihan didukung crosswalk yang dipublikasikan · Editorial Penilaian ControlMapping, beserta alasannya · belum dipetakan, hanya berbagi hasil CSF untuk topik ini · Tidak ada pemetaan dalam data kami belum ada yang dipetakan dalam data kami; sering kali pekerjaan baru, tetapi periksa catatan cakupannya. Metodologi.
ID dan judul persyaratan ditampilkan sebagaimana diterbitkan masing-masing framework, dalam bahasa Inggris.
Pemetaan salah atau belum ada? Laporkan
Tentang Kontrol Akses
Kontrol akses memastikan hanya pengguna, perangkat, dan proses yang berwenang yang dapat mengakses sumber daya organisasi, dengan menerapkan prinsip hak akses minimum (least privilege) dan kebutuhan mengetahui (need-to-know). Elemen implementasi inti mencakup manajemen siklus hidup identitas, kontrol akses berbasis peran (role-based access control/RBAC), tinjauan akses dan kampanye resertifikasi secara berkala, serta alur kerja penyediaan dan penghapusan akses otomatis. Kontrol akses yang kuat mengurangi permukaan serangan dengan membatasi peluang pergerakan lateral dan mencegah akses tidak sah ke sistem serta data yang sensitif.