ACC-01Identity and Access
Joiners, movers, leavers
Access is provisioned on a documented request, changed when a role changes and removed promptly on departure.
Why it exists
Most access findings are movers nobody re-baselined.
What usually proves it
Provisioning records, termination checklist, timing evidence.
Smaller organizations
A checklist run the same day someone leaves.
Mapped to
- Fully addressedSOC 2 Trust Services Criteria · CC6.2
- Fully addressedISO/IEC 27001 Annex A · A.5.18
- Fully addressedNIST Cybersecurity Framework · PR.AA-05
- Fully addressedPCI DSS · 8.2.4
- Fully addressedHIPAA Security Rule · 164.308(a)(3)(ii)(C)
- Partially addressedGDPR · Art. 32 — Through appropriate access measures.
- Deliberately absentEU AI Act — Not addressed; access control is left to sectoral and general law.
- Partially addressedNIST AI Risk Management Framework · MANAGE 2.2 — Access to AI systems within risk treatment.