Authentication and Access Control (AC)

Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties


Login

Authentication and Access Control (AC)

Network integrity is protected (e.g., network segregation, network segmentation)


Login

Authentication and Access Control (AC)

Identities are proofed and bound to credentials and asserted in interactions


Login

Authentication and Access Control (AC)

Users, devices, and other assets are authenticated (e.g., single-factor, multi-factor) commensurate with the risk of the transaction (e.g., individuals’ security and privacy risks and other organizational risks)


Login

Awareness and Training (AT)

All users are informed and trained


Login

Awareness and Training (AT)

Privileged users understand their roles and responsibilities


Login

Awareness and Training (AT)

Third-party stakeholders (e.g., suppliers, customers, partners) understand their roles and responsibilities


Login

Awareness and Training (AT)

Senior executives understand their roles and responsibilities


Login

Awareness and Training (AT)

Physical and cybersecurity personnel understand their roles and responsibilities


Login

Data Security (DS)

Data-at-rest is protected


Login