Control CTRL-IAM-001
← Gap Assessment · Evidence view · Task view
Framework coverage
| Framework | Requirement | Mapping | Delta | Rationale |
|---|---|---|---|---|
Framework A (ISO-like)2013.1 | A.5.2 Privileged access review annual | PARTIAL | ISO requires annual privileged access review; PAM currently enforces continuous authz only | PAM covers privileged access but review cadence differs |
Framework B (NIS2-like)2026.1 | NIS2-IAM Privileged access controls | PARTIAL | NIS2 expects semi-annual review of privileged accounts | PAM supports NIS2 privileged access; semi-annual review missing |
Framework C (CSF-like)2.0 | PR.AA-01 Identity and credentials | FULL | — | CSF identity/credentials covered by PAM |
Framework C (CSF-like)2.0 | RC.RP-01 Recovery plan | SUPPORTING | Full recovery plan / BCP still required beyond IAM | PAM supports recovery identity restoration only |