NIST PF PR.AC-P - Identity Management, Authentication, and Access Control
Manage identities and credentials, physical and remote access, least privilege and separation of duties, network integrity, and identity proofing and authentication proportionate to transaction risks.
Where this comes from
Provision: PR.AC-P - Identity Management, Authentication, and Access Control
Instrument: NIST Privacy Framework Version 1.0
Citation: NIST Privacy Framework Version 1.0 (16 January 2020), Core, PR.AC-P1 through PR.AC-P6
Text version: NIST Privacy Framework 1.0 Core, 16 January 2020 (not PF 1.1)
Checked against the source: 6 September 2026
Who it applies to
It applies when all of these are true:
- NIST PF 1.0 Target Profile adopted: YES
- PR.AC-P: Which outcomes are selected in this project's Target Profile? is PR.AC-P1, PR.AC-P2, PR.AC-P3, PR.AC-P4, PR.AC-P5 or PR.AC-P6
What engineering work it implies
Sample acceptance criteria Landfall generates for this obligation:
- Identities/credentials are issued, verified, and revoked; users, services, and devices are authenticated (MFA where risk warrants)
- Access permissions enforce least privilege and separation of duties and are reviewed periodically
- Access to personal data is role-based and limited to individuals who require it for their function
- Physical/remote access and network integrity (segmentation) are managed
- Access grants, changes, and revocations are logged and auditable
Questions people ask
- Does NIST PF PR.AC-P - Identity Management, Authentication, and Access Control apply to my service?
- It applies when NIST PF 1.0 Target Profile adopted: YES; PR.AC-P: Which outcomes are selected in this project's Target Profile? is PR.AC-P1, PR.AC-P2, PR.AC-P3, PR.AC-P4, PR.AC-P5 or PR.AC-P6.
- From when does this apply?
- NIST PF PR.AC-P - Identity Management, Authentication, and Access Control applies from 16 January 2020. Its current status is: in force.
Find out whether this one lands on you
Landfall's pre-scan answers the applicability question above for your product in minutes, then turns every obligation that applies into traceable engineering tickets with a citation chain your auditors can follow.
Not legal advice. Landfall maps regulatory obligations to engineering work for planning purposes. Its verdicts are not legal advice and create no attorney-client relationship — verify with qualified counsel before relying on them.