PR.AA-05 says access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate least privilege and separation of duties. To meet it, write down who should have what, give people only that, and check regularly that reality still matches the policy. The review is the part most companies skip.
What good looks like
A role based access model exists on paper and in the tools. Admin rights are rare and justified. Nobody can both request and approve their own payments or push and approve their own production change. Access reviews happen on a schedule and when people change roles or leave, and findings turn into removals that actually happen.
NIST's examples: review logical and physical access periodically and whenever someone changes role or leaves, and promptly remove what is no longer needed. Consider attributes of the requester and the resource, such as location, time, and device health, in authorization decisions. Restrict access to the minimum necessary. Periodically review privileges tied to critical business functions to confirm separation of duties.
How to implement it
- Write an access control policy that defines roles, who approves each, and the default of least privilege.
- Map roles to groups in your identity provider so permissions follow group membership, not individual grants.
- Identify toxic combinations, for example developer plus production admin plus approver, and split them.
- Reduce standing admin access. Use time limited elevation for production and cloud consoles.
- Run access reviews quarterly for critical systems and twice a year for the rest. Give each reviewer a list, not a spreadsheet of IDs they cannot interpret.
- Record every decision, keep or remove, and verify removals were completed.
- Trigger a mini review on role change and offboarding.
- Where your tools allow it, add conditions such as managed device only or sign in from expected regions for sensitive systems.
Try it yourself
This walkthrough runs a review campaign from reviewer assignment to verified removal.
Click through it at your own pace, or open it full screen.
Evidence to collect
- The access control policy and role definitions
- Group to permission mappings
- Completed review records with reviewer, decision, and date
- Tickets or logs proving removals
- A separation of duties matrix with exceptions and compensating controls
- Records for role change and leaver reviews
Common gaps
- Reviews approve everything because reviewers lack context
- Removals are agreed but not carried out
- Admin access accumulates from old projects
- Separation of duties is stated in policy but untested
- Physical access, such as office badges and server room entry, is left out of the review
Quick check
How often should access be reviewed?
The outcome says periodically. Quarterly for critical systems and admin roles is a common starting point, with an extra review when someone moves or leaves.
Can one person hold two conflicting duties?
Only as a documented exception with a compensating control, such as a second reviewer or a log review. Record it in line with how you handle exceptions under ID.RA-07.
Sources
- NIST, The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29 (February 2024), Appendix A, CSF Core: https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
- NIST CSF 2.0 landing page: https://csrc.nist.gov/pubs/cswp/29/the-nist-cybersecurity-framework-csf-20/final
The CSF is voluntary guidance. There is no CSF certification, so nothing here makes a company "CSF certified". You describe your own practices against the outcomes.
