Skip to main content

💼 PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization

  • ID: /frameworks/nist-csf-v2.0/pr-aa/01

Description​

  1. Initiate requests for new access or additional access for employees, contractors, and others, and track, review, and fulfill the requests, with permission from system or data owners when needed
  2. Issue, manage, and revoke cryptographic certificates and identity tokens, cryptographic keys (i.e., key management), and other credentials
  3. Select a unique identifier for each device from immutable hardware characteristics or an identifier securely provisioned to the device
  4. Physically label authorized hardware with an identifier for inventory and servicing purposes

Similar​

  • Sections
    • /frameworks/nist-csf-v1.1/pr-ac/01
    • /frameworks/nist-sp-800-53-r5/ac/01
    • /frameworks/nist-sp-800-53-r5/ac/02
    • /frameworks/nist-sp-800-53-r5/ac/14
    • /frameworks/nist-sp-800-53-r5/ia/01
    • /frameworks/nist-sp-800-53-r5/ia/02
    • /frameworks/nist-sp-800-53-r5/ia/03
    • /frameworks/nist-sp-800-53-r5/ia/04
    • /frameworks/nist-sp-800-53-r5/ia/05
    • /frameworks/nist-sp-800-53-r5/ia/06
    • /frameworks/nist-sp-800-53-r5/ia/07
    • /frameworks/nist-sp-800-53-r5/ia/08
    • /frameworks/nist-sp-800-53-r5/ia/09
    • /frameworks/nist-sp-800-53-r5/ia/10
    • /frameworks/nist-sp-800-53-r5/ia/11

Similar Sections (Take Policies From)​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 NIST CSF v1.1 → 💼 PR.AC-1: Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users and processes1934no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-1 Policy and Proceduresno data
💼 NIST SP 800-53 Revision 5 → 💼 AC-2 Account Management132037no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-14 Permitted Actions Without Identification or Authentication1no data
💼 NIST SP 800-53 Revision 5 → 💼 IA-1 Policy and Proceduresno data
💼 NIST SP 800-53 Revision 5 → 💼 IA-2 Identification and Authentication (organizational Users)133no data
💼 NIST SP 800-53 Revision 5 → 💼 IA-3 Device Identification and Authentication4no data
💼 NIST SP 800-53 Revision 5 → 💼 IA-4 Identifier Management9no data
💼 NIST SP 800-53 Revision 5 → 💼 IA-5 Authenticator Management1816no data
💼 NIST SP 800-53 Revision 5 → 💼 IA-6 Authentication Feedbackno data
💼 NIST SP 800-53 Revision 5 → 💼 IA-7 Cryptographic Module Authenticationno data
💼 NIST SP 800-53 Revision 5 → 💼 IA-8 Identification and Authentication (non-organizational Users)6no data
💼 NIST SP 800-53 Revision 5 → 💼 IA-9 Service Identification and Authentication2no data
💼 NIST SP 800-53 Revision 5 → 💼 IA-10 Adaptive Authenticationno data
💼 NIST SP 800-53 Revision 5 → 💼 IA-11 Re-authenticationno data

Sub Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance

Policies (42)​

PolicyLogic CountFlagsCompliance
🛡️ AWS Account IAM Access Analyzer is not enabled for all regions🟢1🟢 x6no data
🛡️ AWS Account IAM Password Policy Number of passwords to remember is not set to 24🟢1🟢 x6no data
🛡️ AWS Account Root User credentials were used is the last 30 days🟢1🟢 x6no data
🛡️ AWS EC2 Instance IAM role is not attached🟢1🟢 x6no data
🛡️ AWS IAM Policy allows full administrative privileges🟢1🟢 x6no data
🛡️ AWS IAM Server Certificate is expired🟢1🟢 x6no data
🛡️ AWS IAM User Access Keys are not rotated every 90 days or less🟢1🟢 x6no data
🛡️ AWS IAM User has inline or directly attached policies🟢1🟠 x1, 🟢 x5no data
🛡️ AWS IAM User has more than one active access key🟢1🟢 x6no data
🛡️ AWS IAM User MFA is not enabled for all users with console password🟢1🟢 x6no data
🛡️ AWS IAM User with console and programmatic access set during the initial creation🟢⚪🟢 x2, ⚪ x1no data
🛡️ AWS IAM User with credentials unused for 45 days or more is not disabled🟢1🟢 x6no data
🛡️ AWS KMS Symmetric CMK Rotation is not enabled🟢1🟢 x6no data
🛡️ AWS S3 Bucket MFA Delete is not enabled🟠🟢1🟠 x1, 🟢 x6no data
🛡️ Azure App Service Authentication is disabled and Basic Authentication is enabled🟢1🟢 x6no data
🛡️ Azure App Service Basic Authentication is enabled🟢⚪🟢 x2, ⚪ x1no data
🛡️ Azure App Service is not registered with Microsoft Entra ID🟢1🟢 x6no data
🛡️ Azure Key Vault Soft Delete and Purge Protection functions are not enabled🟢1🟢 x6no data
🛡️ Azure Non-RBAC Key Vault stores Keys without expiration date🟢1🟢 x6no data
🛡️ Azure Non-RBAC Key Vault stores Secrets without expiration date🟢1🟢 x6no data
🛡️ Azure RBAC Key Vault stores Keys without expiration date🟢1🟢 x6no data
🛡️ Azure RBAC Key Vault stores Secrets without expiration date🟢1🟢 x6no data
🛡️ Consumer Google Accounts are used🟢⚪🟢 x2, ⚪ x1no data
🛡️ Google Accounts are not configured with MFA🟢⚪🟢 x2, ⚪ x1no data
🛡️ Google BigQuery Dataset is anonymously or publicly accessible🟢1🟢 x6no data
🛡️ Google BigQuery Dataset is not encrypted with Customer-Managed Encryption Key (CMEK)🟢1🟢 x6no data
🛡️ Google BigQuery Table is not encrypted with Customer-Managed Encryption Key (CMEK)🟢1🟢 x6no data
🛡️ Google Cloud Audit Logging is not configured properly🟢1🟢 x6no data
🛡️ Google Dataproc Cluster is not encrypted using Customer-Managed Encryption Key🟢1🟢 x6no data
🛡️ Google GCE Disk for critical VMs is not encrypted with Customer-Supplied Encryption Key (CSEK)🟢1🟢 x6no data
🛡️ Google GCE Instance Block Project-Wide SSH Keys is not enabled🟢1🟢 x6no data
🛡️ Google GCE Instance Confidential Compute is not enabled🟢1🟢 x6no data
🛡️ Google GCE Instance is configured to use the Default Service Account🟢1🟢 x6no data
🛡️ Google GCE Instance is configured to use the Default Service Account with full access to all Cloud APIs🟢1🟢 x6no data
🛡️ Google GCE Instance OS Login is not enabled🟢1🟢 x6no data
🛡️ Google GKE Cluster Node Pool uses default Service account🟢1🟢 x6no data
🛡️ Google IAM Policy Binding Member (User) is assigned a basic role🟢1🟢 x6no data
🛡️ Google IAM Users are assigned the Service Account User or Service Account Token Creator roles at Project level🟢1🟢 x6no data
🛡️ Google Project with KMS keys has a principal with Owner role🟢1🟢 x6no data
🛡️ Google Resource Manager Organization has a Redis IAM role assigned🟢1🟢 x6no data
🛡️ Google Storage Bucket is anonymously or publicly accessible🟢1🟢 x6no data
🛡️ Google User has both Service Account Admin and Service Account User roles assigned🟢1🟢 x6no data