ACC-01 · Identity and Access
Joiners, movers, leavers
Access is provisioned on a documented request, changed when a role changes and removed promptly on departure.
5frameworks fully address it
2partially
1leave it out
SOC 2 ISO 27001 NIST CSF PCI DSS HIPAA GDPR EU AI Act NIST AI RMF
1Where each framework asks for it
- SOC 2FullCC6.2
- ISO 27001FullA.5.18
- NIST CSFFullPR.AA-05
- PCI DSSFull8.2.4
- HIPAAFull164.308(a)(3)(ii)(C)
- GDPRPartialArt. 32 Through appropriate access measures.
- EU AI ActAbsent Not addressed; access control is left to sectoral and general law.
- NIST AI RMFPartialMANAGE 2.2 Access to AI systems within risk treatment.
Build the control once against this objective and cite the clause each auditor asks about. A partial mapping says what the framework leaves out; an absence is a finding about the framework, not a gap in your program.
2What usually proves it
Provisioning records, termination checklist, timing evidence.
?Why it exists
Most access findings are movers nobody re-baselined.
For a smaller organizationA checklist run the same day someone leaves.