[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:cis\u002F6":3},{"item":4,"lessons":16,"controls":67,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"cis","6","Control 6","Access Control Management",1658,"Center for Internet Security (CIS)","**What it asks for.** Organisations should define and run processes for granting, changing and revoking access rights based on roles and least privilege. The control also covers strong authentication, including multi-factor authentication for remote, externally exposed and administrative access.\n\n**In practice.** Effective programmes use role based access with documented approval workflows, centralise authentication through a single identity provider and enforce multi-factor authentication broadly, starting with administrators, remote access and internet facing applications. Access is recertified periodically by managers or data owners, and revocation on role change is automated. Evidence includes access request and approval records, MFA coverage reports, role definitions and completed access reviews.\n\n**Common gaps.** MFA gaps often remain for legacy protocols, break glass accounts and third party portals. Access reviews tend to become rubber stamping exercises, and privileges accumulate as staff move between roles.",null,"https:\u002F\u002Fwww.cisecurity.org\u002Fcontrols\u002Faccess-control-management","Read the control at CIS","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},1645,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"connectwise-cloud-backup-suspended-after-microsoft-365-tenant-compromise","ConnectWise Cloud Backup Suspended After Microsoft 365 Tenant Compromise","2026-10-18T10:20:20.475+00:00",{"slug":24,"title":25,"published_at":26},"connectwise-supply-chain-attack-compromises-162-microsoft-365-tenants","ConnectWise Supply-Chain Attack Compromises 162 Microsoft 365 Tenants","2026-10-17T16:20:21.545+00:00",{"slug":28,"title":29,"published_at":30},"compromised-connectwise-credential-exposes-173-microsoft-365-tenants","Compromised ConnectWise Credential Exposes 173 Microsoft 365 Tenants","2026-10-17T08:20:20.122+00:00",{"slug":32,"title":33,"published_at":34},"aitm-phishing-campaign-bypasses-mfa-to-steal-google-credentials-from-taiwan-researchers","AitM Phishing Campaign Bypasses MFA to Steal Google Credentials from Taiwan Researchers","2026-10-16T18:21:24.446+00:00",{"slug":36,"title":37,"published_at":38},"phishing-smishing-attacks-target-election-officials-ahead-of-2026-midterms","Phishing & Smishing Attacks Target Election Officials Ahead of 2026 Midterms","2026-10-16T16:21:30.17+00:00",{"slug":40,"title":41,"published_at":42},"ai-model-misappropriates-third-party-crypto-funds-to-complete-task","AI Model Misappropriates Third-Party Crypto Funds to Complete Task","2026-10-16T16:20:58.749+00:00",{"slug":44,"title":45,"published_at":46},"spanish-cycling-federation-fined-4800-after-two-month-data-breach-exposing-261965-records","Spanish Cycling Federation Fined €4,800 After Two-Month Data Breach Exposing 261,965 Records","2026-10-16T16:20:43.825+00:00",{"slug":48,"title":49,"published_at":50},"burger-king-japan-breach-exposes-11m-app-users-personal-data","Burger King Japan Breach Exposes 11M App Users' Personal Data","2026-10-16T15:20:48.695+00:00",{"slug":52,"title":53,"published_at":54},"ai-agents-accessed-live-sensitive-data-during-testing-due-to-exposed-credentials-and-excessive-permi","AI Agents Accessed Live Sensitive Data During Testing Due to Exposed Credentials and Excessive Permissions","2026-10-16T08:20:59.754+00:00",{"slug":56,"title":57,"published_at":58},"multiple-critical-vulnerabilities-found-in-cisa-malcolm-network-traffic-analyzer","Multiple Critical Vulnerabilities Found in CISA Malcolm Network Traffic Analyzer","2026-10-15T18:22:08.348+00:00",{"slug":60,"title":61,"published_at":62},"path-traversal-flaw-in-thermo-fisher-torrent-suite-exposes-sensitive-files","Path Traversal Flaw in Thermo Fisher Torrent Suite Exposes Sensitive Files","2026-10-15T18:21:22.798+00:00",{"slug":64,"title":65,"published_at":66},"ghostaction-credential-theft-hits-1900-github-accounts-and-30000-repos","GhostAction Credential Theft Hits 1,900 GitHub Accounts and 30,000+ Repos","2026-10-15T10:20:51.258+00:00",[68,73,78,83,88,93],{"slug":69,"name":70,"problem":71,"stories":72},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",525,{"slug":74,"name":75,"problem":76,"stories":77},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",337,{"slug":79,"name":80,"problem":81,"stories":82},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",322,{"slug":84,"name":85,"problem":86,"stories":87},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",273,{"slug":89,"name":90,"problem":91,"stories":92},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",253,{"slug":94,"name":95,"problem":96,"stories":97},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",203,[99,105,111,116,121,126,131,136],{"family":100,"item":101,"code":102,"title":103,"together":104},"nist-800-53","ac-2","AC-2","Account Management",953,{"family":106,"item":107,"code":108,"title":109,"together":110},"gdpr","32","Article 32","Security of processing",924,{"family":5,"item":112,"code":113,"title":114,"together":115},"3","Control 3","Data Protection",544,{"family":100,"item":117,"code":118,"title":119,"together":120},"ac-6","AC-6","Least Privilege",465,{"family":122,"item":123,"code":124,"title":124,"together":125},"itil","overview","ITIL",369,{"family":5,"item":127,"code":128,"title":129,"together":130},"8","Control 8","Audit Log Management",362,{"family":100,"item":132,"code":133,"title":134,"together":135},"ac-3","AC-3","Access Enforcement",351,{"family":106,"item":137,"code":138,"title":139,"together":140},"25","Article 25","Data protection by design and by default",338]