Identity Management, Authentication and Access Control (PR.AC)_identity-management-authentication-and-access-control

Identity Management, Authentication and Access Control (PR.AC) Identity Management, Authentication and Access Control

High-Level Description

Function: PROTECT (PR) Framework: NIST Cybersecurity Framework v2.0

Identity Management, Authentication and Access Control

What to Check

• Verify Identity Management, Authentication and Access Control (PR.AC) Identity Management, Authentication and Access Control outcome is achieved
• Review documentation and evidence for Identity Management, Authentication and Access Control (PR.AC)
• Assess organizational maturity for PROTECT function

How to Test

Step 1: Identify Current Profile

Determine the organization's current and target CSF profile tier for Identity Management, Authentication and Access Control (PR.AC).

Step 2: Assess Outcome Achievement

# Review organizational policies and procedures
# Check for evidence that Identity Management, Authentication and Access Control (PR.AC) outcome is met
# Interview stakeholders responsible for PROTECT

Step 3: Map to Technical Controls

Identify which SP 800-53 controls implement this CSF outcome and verify their operating effectiveness.

Tools

Remediation Guide

Achieve the Identity Management, Authentication and Access Control (PR.AC) Identity Management, Authentication and Access Control outcome:

Implement controls that satisfy the Identity Management, Authentication and Access Control outcome per NIST CSF v2.0.

Risk Assessment

CWE Categories

References

• NIST CSF v2.0
• NIST CSF v2.0 Reference Tool
• CSF 2.0 Quick Start Guides

Checklist

• Current profile tier assessed
• Target profile tier defined
• Gap analysis completed
• SP 800-53 control mapping verified
• Implementation roadmap exists