Crossfoot
Crossfoot / Controls / Access provisioning, review and removal
Draft v0.1.06 of 6 frameworks

Access provisioning, review and removal

Access is requested, approved, periodically reviewed and removed on termination or role change.

Where it appears

SOC 2
CC6.2Registers and authorizes new users prior to issuing credentials
CC6.3Authorizes, modifies or removes access based on roles
PCI DSS 4.0
7.2Access to system components and data is appropriately defined and assigned (incl. 7.2.4 six-month review)
7.3Access is managed via an access control system
8.2.5Access for terminated users is immediately revoked
NIST CSF 2.0
PR.AA-05Access permissions, entitlements and authorizations are defined and managed (least privilege, separation of duties)
ISO 27001:2022
A.5.15Access control
A.5.16Identity management
A.5.18Access rights
HIPAA Security Rule
164.308(a)(3)Workforce security (authorization, supervision, termination)
164.308(a)(4)Information access management
NIST 800-53 r5
AC-2Account management
AC-3Access enforcement
PS-4Personnel termination
PS-5Personnel transfer

Evidence auditors usually ask for

A typical starting list. Your assessor's request list is the one that counts.

  • Access request and approval tickets (sample across the audit period)
  • Periodic user access review with reviewer sign-off and remediation of exceptions
  • Terminated-user report reconciled to access removal timestamps
  • Joiner/mover/leaver procedure document

Crosswalks that include this

SOC 2 to PCI DSS 4.0SOC 2 to NIST CSF 2.0SOC 2 to ISO 27001:2022SOC 2 to HIPAA Security RuleSOC 2 to NIST 800-53 r5PCI DSS 4.0 to SOC 2PCI DSS 4.0 to NIST CSF 2.0PCI DSS 4.0 to ISO 27001:2022PCI DSS 4.0 to HIPAA Security RulePCI DSS 4.0 to NIST 800-53 r5NIST CSF 2.0 to SOC 2NIST CSF 2.0 to PCI DSS 4.0