NIST CSF PR.AA - Identity Management, Authentication, and Access Control
Manage identities, implement strong authentication, enforce least-privilege access control, and secure physical access to assets commensurate with risk
Where this comes from
Provision: PR.AA - Identity Management, Authentication, and Access Control
Instrument: NIST Cybersecurity Framework 2.0 (February 2024)
Citation: NIST Cybersecurity Framework 2.0, February 26, 2024, Section PR.AA (Identity Management, Authentication, and Access Control), Sub-categories PR.AA-01 through PR.AA-06
Text version: CSF 2.0
Who it applies to
It applies when all of these are true:
- Service requires/offers account registration
- Data categories collected — any answer
- Service is likely to be accessed by children under 18
What engineering work it implies
- Role-Based Access Control for Child SafetyCovers it fully
Implement granular access controls with age-appropriate feature gating and moderation workflows.
Sample acceptance criteria Landfall generates for this obligation:
- Identities/credentials are issued, verified, and revoked; users, services, and devices are authenticated (MFA where risk warrants)
- Access permissions enforce least privilege and separation of duties and are reviewed periodically
- Access to personal data is role-based and limited to individuals who require it for their function
- Physical/remote access and network integrity (segmentation) are managed
- Access grants, changes, and revocations are logged and auditable
Questions people ask
- Does NIST CSF PR.AA - Identity Management, Authentication, and Access Control apply to my service?
- It applies when Service requires/offers account registration; Data categories collected — any answer; Service is likely to be accessed by children under 18.
- From when does this apply?
- NIST CSF PR.AA - Identity Management, Authentication, and Access Control applies from 26 February 2024. Its current status is: in force.
- What engineering work does this imply?
- Typically: Role-Based Access Control for Child Safety.
Find out whether this one lands on you
Landfall's pre-scan answers the applicability question above for your product in minutes, then turns every obligation that applies into traceable engineering tickets with a citation chain your auditors can follow.
Not legal advice. Landfall maps regulatory obligations to engineering work for planning purposes. Its verdicts are not legal advice and create no attorney-client relationship — verify with qualified counsel before relying on them.