Skip to main content

πŸ’Ό PR.AC-1: Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users and processes

Description​

Empty...

Similar​

  • Sections
    • /frameworks/iso-iec-27001-2013/09/02/01
    • /frameworks/iso-iec-27001-2013/09/02/02
    • /frameworks/iso-iec-27001-2013/09/02/03
    • /frameworks/iso-iec-27001-2013/09/02/04
    • /frameworks/iso-iec-27001-2013/09/02/06
    • /frameworks/iso-iec-27001-2013/09/03/01
    • /frameworks/iso-iec-27001-2013/09/04/02
    • /frameworks/iso-iec-27001-2013/09/04/03
    • /frameworks/nist-sp-800-53-r4/ac/01
    • /frameworks/nist-sp-800-53-r4/ac/02
    • /frameworks/nist-sp-800-53-r4/ia/01
    • /frameworks/nist-sp-800-53-r4/ia/02
    • /frameworks/nist-sp-800-53-r4/ia/03
    • /frameworks/nist-sp-800-53-r4/ia/04
    • /frameworks/nist-sp-800-53-r4/ia/05
    • /frameworks/nist-sp-800-53-r4/ia/06
    • /frameworks/nist-sp-800-53-r4/ia/07
    • /frameworks/nist-sp-800-53-r4/ia/08
    • /frameworks/nist-sp-800-53-r4/ia/09
    • /frameworks/nist-sp-800-53-r4/ia/10
    • /frameworks/nist-sp-800-53-r4/ia/11
  • Internal
    • ID: dec-c-f8ba50fb

Similar Sections (Take Policies From)​

SectionSub SectionsInternal RulesPoliciesFlags
πŸ’Ό ISO/IEC 27001:2013 β†’ πŸ’Ό A.9.2.1 User registration and de-registration11
πŸ’Ό ISO/IEC 27001:2013 β†’ πŸ’Ό A.9.2.2 User access provisioning44
πŸ’Ό ISO/IEC 27001:2013 β†’ πŸ’Ό A.9.2.3 Management of privileged access rights34
πŸ’Ό ISO/IEC 27001:2013 β†’ πŸ’Ό A.9.2.4 Management of secret authentication information of users810
πŸ’Ό ISO/IEC 27001:2013 β†’ πŸ’Ό A.9.2.6 Removal or adjustment of access rights
πŸ’Ό ISO/IEC 27001:2013 β†’ πŸ’Ό A.9.3.1 Use of secret authentication information33
πŸ’Ό ISO/IEC 27001:2013 β†’ πŸ’Ό A.9.4.2 Secure log-on procedures
πŸ’Ό ISO/IEC 27001:2013 β†’ πŸ’Ό A.9.4.3 Password management system11
πŸ’Ό NIST SP 800-53 Revision 4 β†’ πŸ’Ό AC-1 ACCESS CONTROL POLICY AND PROCEDURES
πŸ’Ό NIST SP 800-53 Revision 4 β†’ πŸ’Ό AC-2 ACCOUNT MANAGEMENT1322
πŸ’Ό NIST SP 800-53 Revision 4 β†’ πŸ’Ό IA-1 IDENTIFICATION AND AUTHENTICATION POLICY AND PROCEDURES
πŸ’Ό NIST SP 800-53 Revision 4 β†’ πŸ’Ό IA-2 IDENTIFICATION AND AUTHENTICATION (ORGANIZATIONAL USERS)1311
πŸ’Ό NIST SP 800-53 Revision 4 β†’ πŸ’Ό IA-3 DEVICE IDENTIFICATION AND AUTHENTICATION411
πŸ’Ό NIST SP 800-53 Revision 4 β†’ πŸ’Ό IA-4 IDENTIFIER MANAGEMENT7
πŸ’Ό NIST SP 800-53 Revision 4 β†’ πŸ’Ό IA-5 AUTHENTICATOR MANAGEMENT1522
πŸ’Ό NIST SP 800-53 Revision 4 β†’ πŸ’Ό IA-6 AUTHENTICATOR FEEDBACK
πŸ’Ό NIST SP 800-53 Revision 4 β†’ πŸ’Ό IA-7 CRYPTOGRAPHIC MODULE AUTHENTICATION
πŸ’Ό NIST SP 800-53 Revision 4 β†’ πŸ’Ό IA-8 IDENTIFICATION AND AUTHENTICATION (NON-ORGANIZATIONAL USERS)5
πŸ’Ό NIST SP 800-53 Revision 4 β†’ πŸ’Ό IA-9 SERVICE IDENTIFICATION AND AUTHENTICATION2
πŸ’Ό NIST SP 800-53 Revision 4 β†’ πŸ’Ό IA-10 ADAPTIVE IDENTIFICATION AND AUTHENTICATION
πŸ’Ό NIST SP 800-53 Revision 4 β†’ πŸ’Ό IA-11 RE-AUTHENTICATION

Similar Sections (Give Policies To)​

SectionSub SectionsInternal RulesPoliciesFlags
πŸ’Ό NIST CSF v2.0 β†’ πŸ’Ό PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization23
πŸ’Ό NIST CSF v2.0 β†’ πŸ’Ό PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties58

Sub Sections​

SectionSub SectionsInternal RulesPoliciesFlags

Policies (22)​

PolicyLogic CountFlags
πŸ“ AWS Account IAM Access Analyzer is not enabled for all regions 🟒1🟒 x6
πŸ“ AWS Account IAM Password Policy Number of passwords to remember is not set to 24 🟒1🟒 x6
πŸ“ AWS Account Root User credentials were used is the last 30 days πŸ”΄πŸŸ’1πŸ”΄ x1, 🟒 x6
πŸ“ AWS EC2 Instance IAM role is not attached 🟒1🟒 x6
πŸ“ AWS IAM Policy allows full administrative privileges 🟒1🟒 x6
πŸ“ AWS IAM Server Certificate is expired 🟒1🟒 x6
πŸ“ AWS IAM User Access Keys are not rotated every 90 days or less 🟒1🟒 x6
πŸ“ AWS IAM User has inline or directly attached policies 🟒1🟠 x1, 🟒 x5
πŸ“ AWS IAM User has more than one active access key 🟒1🟒 x6
πŸ“ AWS IAM User MFA is not enabled for all users with console password 🟒1🟒 x6
πŸ“ AWS IAM User with console and programmatic access set during the initial creation 🟒🟒 x3
πŸ“ AWS KMS Symmetric CMK Rotation is not enabled 🟒1🟒 x6
πŸ“ AWS S3 Bucket MFA Delete is not enabled 🟠🟒1🟠 x1, 🟒 x6
πŸ“ Azure App Service Authentication is disabled and Basic Authentication is enabled 🟒1🟒 x6
πŸ“ Azure App Service Basic Authentication is enabled 🟒🟒 x3
πŸ“ Azure App Service is not registered with Microsoft Entra ID 🟒1🟒 x6
πŸ“ Azure Key Vault Soft Delete and Purge Protection functions are not enabled 🟒1🟒 x6
πŸ“ Azure Non-RBAC Key Vault stores Keys without expiration date 🟒1🟒 x6
πŸ“ Azure Non-RBAC Key Vault stores Secrets without expiration date 🟒1🟒 x6
πŸ“ Azure RBAC Key Vault stores Keys without expiration date 🟒1🟒 x6
πŸ“ Azure RBAC Key Vault stores Secrets without expiration date 🟒1🟒 x6
πŸ“ Consumer Google Accounts are used 🟒🟒 x3

Internal Rules​

RulePoliciesFlags
βœ‰οΈ dec-x-0be4dfe51
βœ‰οΈ dec-x-0feec7902
βœ‰οΈ dec-x-1fc681bc1
βœ‰οΈ dec-x-4d6fee7a1
βœ‰οΈ dec-x-6c93750d1
βœ‰οΈ dec-x-12a853391
βœ‰οΈ dec-x-82ca41272
βœ‰οΈ dec-x-157aa4b91
βœ‰οΈ dec-x-4157c58a1
βœ‰οΈ dec-x-307950161
βœ‰οΈ dec-x-ab7fc52e1
βœ‰οΈ dec-x-b10e98af1
βœ‰οΈ dec-x-b92b08f41
βœ‰οΈ dec-x-bcb0c78f1
βœ‰οΈ dec-x-ca52f63a2
βœ‰οΈ dec-x-e58fd8e01
βœ‰οΈ dec-x-f7c2faac1
βœ‰οΈ dec-z-79f4ab881
βœ‰οΈ dec-z-bb7312921