Sekit CSF · Identity & Access Management · Policy

RCF-0085Access reviews (recertification)

Access rights are formally reviewed periodically to confirm they remain appropriate

Mapping at a glance

RCF-0085Access reviews (recertification)Identity & Access Management · Policy

A.5.15Access controlISO/IEC 27001:2022 · Annex A controls A.5.18Access rightsISO/IEC 27001:2022 · Annex A controls PR.AA-03Users and devices authenticatedNIST CSF 2.0 PR.AA-05Access permissions managedNIST CSF 2.0 CE4.1Manage the account lifecycleCyber Essentials

RCF-0085 maps to 6 controls across the published frameworks. +1 more in the table below. Open in the full graph →

Maps to ISO/IEC 27001:2022 · Annex A controls

Curated mapping with the reasoning, not just the codes.

A.5.15Access controlsupportsCommitting to a periodic access review is how A.5.15's access-based-on-need principle stays true over time, instead of only being checked the day an account is created.A.5.18Access rightssupportsCommitting in writing to a periodic access review, naming who reviews and the removal deadline, supports A.5.18's review step, though provisioning and revocation are covered by other Sekit controls.

Maps to NIST CSF 2.0

Curated mapping with the reasoning, not just the codes.

PR.AA-03Users and devices authenticated PR.AA-05Access permissions managed

Maps to Cyber Essentials

Curated mapping with the reasoning, not just the codes.

CE4.1Manage the account lifecycle CE4.2Control administrative privileges

This topic through the other lenses

All Identity & Access Management controls

Ask Sekura: “What evidence proves RCF-0085?”

Connect your AI · free MCP

https://sekit.ai/api/mcp/crosswalk

In Claude or ChatGPT, add a custom connector and paste this URL.
Sign in with your email to finish. Free, read-only, no organization required.