SekitCrosswalk
ENES
Start now
Cyber Essentials · derived mapping target

CE4.1Manage the account lifecycle

Follow a defined process to approve and create user accounts, give each user unique credentials, and disable or remove accounts promptly when a person leaves or after a period of inactivity.

Mapping at a glance
CE4.1Manage the account lifecycleCyber Essentials
RCF-0005Roles & responsibilitiesGovernance & Risk · ProcessRCF-0061Identity lifecycleIdentity & Access Management · PolicyRCF-0062Identity lifecycleIdentity & Access Management · ProcessRCF-0063Identity lifecycleIdentity & Access Management · TechnicalRCF-0068Least privilege / RBACIdentity & Access Management · Process

CE4.1 is covered by 15 Sekit CSF controls. +10 more in the table below. Open in the full graph →

Mapped from the Sekit CSF

The Sekit controls that cover this requirement, lens by lens.

RCF-0005Roles & responsibilities · ProcessRCF-0061Identity lifecycle · PolicyRCF-0062Identity lifecycle · ProcessRCF-0063Identity lifecycle · TechnicalRCF-0068Least privilege / RBAC · ProcessRCF-0085Access reviews (recertification) · PolicyRCF-0086Access reviews (recertification) · ProcessRCF-0088JML (joiner-mover-leaver) · PolicyRCF-0089JML (joiner-mover-leaver) · ProcessRCF-0090JML (joiner-mover-leaver) · TechnicalRCF-0299Facility access control · ProcessRCF-0325Offboarding vendors · PolicyRCF-0326Offboarding vendors · ProcessRCF-0327Offboarding vendors · TechnicalRCF-0335Cloud IAM · Process

ISO/IEC 27001:2022 counterparts

Reached through the Sekit CSF controls both map to — a mapping, not a formal equivalence.

A.5.18 Access rightsA.5.16 Identity managementA.5.15 Access controlA.6.5 Responsibilities after termination or change of employmentA.5.22 Monitoring, review and change management of supplier servicesA.5.19 Information security in supplier relationshipsA.5.4 Management responsibilitiesA.8.2 Privileged access rightsA.5.2 Information security roles and responsibilitiesA.7.2 Physical entryA.5.20 Addressing information security within supplier agreementsA.6.2 Terms and conditions of employment

NIST CSF 2.0 counterparts

PR.AA-05 Access permissions managedPR.AA-01 Identities and credentials managedPR.AA-02 Identities proofed and boundPR.AA-03 Users and devices authenticatedGV.SC-07 Supplier risk managed over relationshipGV.SC-08 Suppliers in incident planningPR.IR-02 Assets protected from environmental threatsGV.RR-01 Leadership accountability for cyber riskGV.RR-02 Roles and responsibilities establishedGV.RR-03 Resources allocated for cybersecurityGV.RR-04 Cybersecurity in human resources

ISO/IEC 42001:2023 — Annex A counterparts

A.3.2 AI roles and responsibilities

Evidence that proves this control

What an auditor, or Sekit's evidence engine, asks for.

Joiner-mover-leaver procedure
The process the company follows when someone joins, changes role, or leaves: how access and devices are granted and removed.
From the Sekit evidence catalog

Related controls

Via the shared Sekit CSF topic, not the framework's own index.

CE4.2 Control administrative privilegesCE4.3 Require multi-factor authentication
Ask Sekura: “What evidence proves CE4.1?”
Also via MCP, free with account