[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-csf\u002Fpr-aa":3},{"item":4,"lessons":16,"controls":35,"related":62},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nist-csf","pr-aa","PR.AA-01","PR.AA: Identity Management, Authentication, and Access Control",3,"US National Institute of Standards and Technology (NIST)","**What it asks for.** This category expects access to physical and logical assets to be limited to authorised users, services and hardware, and managed in proportion to the assessed risk of unauthorised access. It covers identity and credential lifecycle, authentication, identity proofing, access permissions and physical access.\n\n**In practice.** Good practice is a single authoritative identity source, joiner, mover and leaver processes tied to HR records, and phishing-resistant multi-factor authentication for remote, privileged and high-risk access. Permissions follow least privilege and separation of duties, privileged accounts are managed and monitored, and service accounts and machine identities have owners. Access reviews are performed on a schedule with documented outcomes. Auditors will expect identity governance reports, MFA coverage figures, privileged access records, recertification evidence and physical access logs.\n\n**Common gaps.** Common weaknesses are orphaned accounts after people leave, unmanaged service and API credentials, and MFA gaps on legacy systems. Access reviews often become rubber-stamping exercises with little real scrutiny.",null,"https:\u002F\u002Fwww.nist.gov\u002Fcyberframework","Open the Cybersecurity Framework at NIST","2026-10-18T15:18:43.664+00:00",{"total":17,"list":18},4,[19,23,27,31],{"slug":20,"title":21,"published_at":22},"greek-authority-fined-for-unlawful-publication-of-personal-data-on-transparency-portal","Greek Authority Fined for Unlawful Publication of Personal Data on Transparency Portal","2026-10-18T20:20:25.794+00:00",{"slug":24,"title":25,"published_at":26},"ai-agents-are-identities-too-govern-them-accordingly","AI Agents Are Identities Too — Govern Them Accordingly","2026-10-02T14:20:53.418+00:00",{"slug":28,"title":29,"published_at":30},"identity-sprawl-creates-exploitable-dark-matter-across-hybrid-environments","Identity Sprawl Creates Exploitable 'Dark Matter' Across Hybrid Environments","2026-08-28T14:22:08.33+00:00",{"slug":32,"title":33,"published_at":34},"hardcoded-bluetooth-key-exposes-automotive-anti-theft-systems-to-remote-attack","Hardcoded Bluetooth Key Exposes Automotive Anti-Theft Systems to Remote Attack","2026-08-04T16:22:50.484+00:00",[36,41,45,50,54,58],{"slug":37,"name":38,"problem":39,"stories":40},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",2,{"slug":42,"name":43,"problem":44,"stories":40},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":46,"name":47,"problem":48,"stories":49},"patch-management","Automated patch management","Known holes get closed in days, not months.",1,{"slug":51,"name":52,"problem":53,"stories":49},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",{"slug":55,"name":56,"problem":57,"stories":49},"ot-security","OT and industrial control system security","Factory, building and utility control systems get visibility and protection.",{"slug":59,"name":60,"problem":61,"stories":49},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[63,68,73,78,81,85,89,93],{"family":64,"item":65,"code":66,"title":67,"together":9},"gdpr","32","Article 32","Security of processing",{"family":69,"item":70,"code":71,"title":72,"together":40},"nist-800-53","ac-2","AC-2","Account Management",{"family":74,"item":75,"code":76,"title":77,"together":40},"cis","16","Control 16","Application Software Security",{"family":74,"item":79,"code":80,"title":72,"together":40},"5","Control 5",{"family":74,"item":82,"code":83,"title":84,"together":40},"6","Control 6","Access Control Management",{"family":86,"item":87,"code":88,"title":88,"together":40},"itil","overview","ITIL",{"family":64,"item":90,"code":91,"title":92,"together":40},"25","Article 25","Data protection by design and by default",{"family":69,"item":94,"code":95,"title":96,"together":40},"ac-6","AC-6","Least Privilege"]