ACC-02 · Identity and Access
Access reviewed on a cadence
Entitlements are reviewed by someone who can judge them, with revocations tracked to completion.
5frameworks fully address it
1partially
2leave it out
SOC 2 ISO 27001 NIST CSF PCI DSS HIPAA GDPR EU AI Act NIST AI RMF
1Where each framework asks for it
- SOC 2FullCC6.3
- ISO 27001FullA.5.18
- NIST CSFFullPR.AA-05
- PCI DSSFull7.2.4
- HIPAAFull164.308(a)(4)(ii)(C)
- GDPRPartialArt. 32 Implied by appropriate measures.
- EU AI ActAbsent Not addressed.
- NIST AI RMFAbsent Not addressed at control level.
Build the control once against this objective and cite the clause each auditor asks about. A partial mapping says what the framework leaves out; an absence is a finding about the framework, not a gap in your program.
2What usually proves it
Review packs, reviewer decisions, revocation evidence, completeness statement.
?Why it exists
A review that produces no revocations was not a review.
For a smaller organizationQuarterly, one reviewer per system, evidence kept.