ACC-03 · Identity and Access
Strong authentication
Authentication is proportionate to risk, with multi-factor authentication on administrative and remote access.
4frameworks fully address it
2partially
2leave it out
SOC 2 ISO 27001 NIST CSF PCI DSS HIPAA GDPR EU AI Act NIST AI RMF
1Where each framework asks for it
- SOC 2FullCC6.1
- ISO 27001FullA.8.5
- NIST CSFFullPR.AA-03
- PCI DSSFull8.4
- HIPAAPartial164.312(d) Person or entity authentication without specifying factors.
- GDPRPartialArt. 32 Through appropriate measures.
- EU AI ActAbsent Not addressed.
- NIST AI RMFAbsent Not addressed at control level.
Build the control once against this objective and cite the clause each auditor asks about. A partial mapping says what the framework leaves out; an absence is a finding about the framework, not a gap in your program.
2What usually proves it
Authentication configuration, MFA coverage report, exceptions.
?Why it exists
Credential theft remains the most common entry point.
For a smaller organizationMFA on everything that matters, with no shared logins.