ACC-04 · Identity and Access
Privileged access controlled
Administrative access is limited, separately approved, monitored and time-bound where possible.
4frameworks fully address it
1partially
3leave it out
SOC 2 ISO 27001 NIST CSF PCI DSS HIPAA GDPR EU AI Act NIST AI RMF
1Where each framework asks for it
- SOC 2FullCC6.1
- ISO 27001FullA.8.2
- NIST CSFFullPR.AA-05
- PCI DSSFull7.2.2
- HIPAAPartial164.308(a)(4) Through access authorization.
- GDPRAbsent No privileged access concept; covered generally by Art. 32.
- EU AI ActAbsent Not addressed.
- NIST AI RMFAbsent Not addressed at control level.
Build the control once against this objective and cite the clause each auditor asks about. A partial mapping says what the framework leaves out; an absence is a finding about the framework, not a gap in your program.
2What usually proves it
Privileged account inventory, approval records, session logs.
?Why it exists
Standing administrative access is the largest single blast radius.
For a smaller organizationTwo named admins, reviewed monthly.