PR.AA-01 says identities and credentials for authorized users, services, and hardware are managed by the organization. That covers people, but also service accounts, API keys, certificates, and devices. The outcome is met when you can list who and what has an identity, who approved it, and how credentials are issued, rotated, and revoked.
What good looks like
Every account traces to an owner. Joiners get access through a request that data or system owners approve. Leavers lose access the same day. Machine credentials are inventoried and rotated, not pasted into a wiki.
NIST's examples are four. Initiate, track, review, and fulfill requests for new or added access for employees, contractors, and others, with permission from owners when needed. Issue, manage, and revoke cryptographic certificates, identity tokens, keys, and other credentials. Select a unique identifier for each device from immutable hardware characteristics or one securely provisioned to it. Physically label authorized hardware with an identifier for inventory and servicing.
How to implement it
- Pick one identity provider as the source of truth for people and connect your main apps to it.
- Use an access request form or ticket type. Record requester, resource, approver, and date.
- Tie account removal to HR events. Departure triggers a checklist that includes SaaS accounts, cloud consoles, and code repositories.
- Inventory service accounts, API tokens, and signing keys. Give each an owner and an expiry or rotation date.
- Keep secrets in a secrets manager, and scan repositories for leaked credentials.
- Enroll devices in an inventory with a unique ID and label them. Only enrolled devices reach company systems.
Evidence to collect
- A list of identities by type with owners
- Sample access requests with approvals
- Offboarding checklists with timestamps
- A credential inventory showing rotation dates
- A device inventory with identifiers
Common gaps
- Service accounts have no owner and never rotate
- Contractors stay active after the project ends
- Shared admin credentials sit in a password note
- Offboarding covers email but not the code host or cloud account
Quick check
Are API keys part of this outcome?
Yes. The outcome names credentials for services as well as users, and NIST lists tokens and keys explicitly.
Sources
- NIST, The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29 (February 2024), Appendix A, CSF Core: https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
- NIST CSF 2.0 landing page: https://csrc.nist.gov/pubs/cswp/29/the-nist-cybersecurity-framework-csf-20/final
The CSF is voluntary guidance. There is no CSF certification, so nothing here makes a company "CSF certified". You describe your own practices against the outcomes.
