Identity Management, Authentication, and Access Control (PR.AA)_identity-management-authentication-and-access-control

Identity Management, Authentication, and Access Control (PR.AA) Identity Management, Authentication, and Access Control

High-Level Description

Function: PROTECT (PR) Framework: NIST Cybersecurity Framework v2.0

Access to physical and logical assets is limited to authorized users, services, and hardware and managed commensurate with the assessed risk of unauthorized access

What to Check

• Verify Identity Management, Authentication, and Access Control (PR.AA) Identity Management, Authentication, and Access Control outcome is achieved
• Review documentation and evidence for Identity Management, Authentication, and Access Control (PR.AA)
• Assess organizational maturity for PROTECT function

How to Test

Step 1: Identify Current Profile

Determine the organization's current and target CSF profile tier for Identity Management, Authentication, and Access Control (PR.AA).

Step 2: Assess Outcome Achievement

# Review organizational policies and procedures
# Check for evidence that Identity Management, Authentication, and Access Control (PR.AA) outcome is met
# Interview stakeholders responsible for PROTECT

Step 3: Map to Technical Controls

Identify which SP 800-53 controls implement this CSF outcome and verify their operating effectiveness.

Tools

Remediation Guide

Achieve the Identity Management, Authentication, and Access Control (PR.AA) Identity Management, Authentication, and Access Control outcome:

Access to physical and logical assets is limited to authorized users, services, and hardware and managed commensurate with the assessed risk of unauthorized access

Risk Assessment

CWE Categories

References

• NIST CSF v2.0
• NIST CSF v2.0 Reference Tool
• CSF 2.0 Quick Start Guides

Checklist

• Current profile tier assessed
• Target profile tier defined
• Gap analysis completed
• SP 800-53 control mapping verified
• Implementation roadmap exists