SekitCrosswalk
ENES
Start now
NIST CSF 2.0 · derived mapping target

PR.AA-02Identities proofed and bound

Verify that people are who they claim to be before issuing credentials, with rigor matched to the sensitivity of the access. Weak proofing undermines every control downstream.

Mapping at a glance
PR.AA-02Identities proofed and boundNIST CSF 2.0
RCF-0061Identity lifecycleIdentity & Access Management · PolicyRCF-0062Identity lifecycleIdentity & Access Management · ProcessRCF-0063Identity lifecycleIdentity & Access Management · TechnicalRCF-0064Strong authentication (MFA)Identity & Access Management · PolicyRCF-0065Strong authentication (MFA)Identity & Access Management · Process

PR.AA-02 is covered by 18 Sekit CSF controls. +13 more in the table below. Open in the full graph →

Mapped from the Sekit CSF

The Sekit controls that cover this requirement, lens by lens.

RCF-0061Identity lifecycle · PolicyRCF-0062Identity lifecycle · ProcessRCF-0063Identity lifecycle · TechnicalRCF-0064Strong authentication (MFA) · PolicyRCF-0065Strong authentication (MFA) · ProcessRCF-0066Strong authentication (MFA) · TechnicalRCF-0073SSO & federation · PolicyRCF-0074SSO & federation · ProcessRCF-0075SSO & federation · TechnicalRCF-0076Password policy · PolicyRCF-0077Password policy · ProcessRCF-0078Password policy · TechnicalRCF-0079Session management · PolicyRCF-0080Session management · ProcessRCF-0081Session management · TechnicalRCF-0088JML (joiner-mover-leaver) · PolicyRCF-0089JML (joiner-mover-leaver) · ProcessRCF-0090JML (joiner-mover-leaver) · Technical

ISO/IEC 27001:2022 counterparts

Reached through the Sekit CSF controls both map to — a mapping, not a formal equivalence.

A.5.16 Identity managementA.5.15 Access controlA.8.5 Secure authenticationA.5.17 Authentication informationA.5.18 Access rightsA.5.1 Policies for information securityA.6.5 Responsibilities after termination or change of employmentA.6.3 Information security awareness, education and trainingA.8.1 User endpoint devicesA.5.10 Acceptable use of information and other associated assetsA.5.8 Information security in project managementA.7.7 Clear desk and clear screen

Cyber Essentials counterparts

CE4.1 Manage the account lifecycleCE4.4 Protect passwords against guessingCE4.3 Require multi-factor authenticationCE2.3 Enforce device unlocking credentialsCE2.2 Change default and guessable passwords

Evidence that proves this control

What an auditor, or Sekit's evidence engine, asks for.

Joiner-mover-leaver procedure
The process the company follows when someone joins, changes role, or leaves: how access and devices are granted and removed.
From the Sekit evidence catalog

Related controls

Via the shared Sekit CSF topic, not the framework's own index.

PR.AA-01 Identities and credentials managedPR.AA-05 Access permissions managed
Ask Sekura: “What evidence proves PR.AA-02?”
Also via MCP, free with account