[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:cis\u002F6":3},{"item":4,"lessons":16,"controls":67,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"cis","6","Control 6","Access Control Management",1658,"Center for Internet Security (CIS)","**What it asks for.** Organisations should define and run processes for granting, changing and revoking access rights based on roles and least privilege. The control also covers strong authentication, including multi-factor authentication for remote, externally exposed and administrative access.\n\n**In practice.** Effective programmes use role based access with documented approval workflows, centralise authentication through a single identity provider and enforce multi-factor authentication broadly, starting with administrators, remote access and internet facing applications. Access is recertified periodically by managers or data owners, and revocation on role change is automated. Evidence includes access request and approval records, MFA coverage reports, role definitions and completed access reviews.\n\n**Common gaps.** MFA gaps often remain for legacy protocols, break glass accounts and third party portals. Access reviews tend to become rubber stamping exercises, and privileges accumulate as staff move between roles.",null,"https:\u002F\u002Fwww.cisecurity.org\u002Fcontrols\u002Faccess-control-management","Read the control at CIS","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},1734,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"crypto-exchange-names-used-to-mask-unauthorized-screenconnect-sessions","Crypto Exchange Names Used to Mask Unauthorized ScreenConnect Sessions","2026-11-14T00:20:22.527+00:00",{"slug":24,"title":25,"published_at":26},"unsecured-ai-agent-exposes-enterprise-to-invoice-fraud-via-email-manipulation","Unsecured AI Agent Exposes Enterprise to Invoice Fraud via Email Manipulation","2026-11-13T16:22:22.358+00:00",{"slug":28,"title":29,"published_at":30},"baker-tilly-breach-and-ai-privilege-escalation-highlight-third-party-and-access-control-risks","Baker Tilly Breach and AI Privilege Escalation Highlight Third-Party and Access Control Risks","2026-11-13T16:21:20.633+00:00",{"slug":32,"title":33,"published_at":34},"weak-sql-server-passwords-enable-brute-force-takeover-and-malware-deployment","Weak SQL Server Passwords Enable Brute-Force Takeover and Malware Deployment","2026-11-13T15:20:23.452+00:00",{"slug":36,"title":37,"published_at":38},"stolen-credential-exposes-apify-customer-data-highlighting-mfa-and-secrets-management-gaps","Stolen Credential Exposes Apify Customer Data, Highlighting MFA and Secrets Management Gaps","2026-11-13T13:20:22.45+00:00",{"slug":40,"title":41,"published_at":42},"compromised-iam-credentials-and-third-party-vendor-breaches-expose-customer-data-across-multiple-org","Compromised IAM Credentials and Third-Party Vendor Breaches Expose Customer Data Across Multiple Organizations","2026-11-13T11:21:34.52+00:00",{"slug":44,"title":45,"published_at":46},"device-code-phishing-bypasses-mfa-by-abusing-legitimate-microsoft-auth-flow","Device Code Phishing Bypasses MFA by Abusing Legitimate Microsoft Auth Flow","2026-11-13T08:22:33.154+00:00",{"slug":48,"title":49,"published_at":50},"stolen-credentials-linked-to-school-bomb-threats-highlight-infostealer-risk","Stolen Credentials Linked to School Bomb Threats Highlight Infostealer Risk","2026-11-13T00:20:55.052+00:00",{"slug":52,"title":53,"published_at":54},"third-party-screenconnect-add-on-abused-to-bypass-auth-and-deploy-rogue-rmm-tools","Third-Party ScreenConnect Add-On Abused to Bypass Auth and Deploy Rogue RMM Tools","2026-11-12T21:20:21.093+00:00",{"slug":56,"title":57,"published_at":58},"sckit-malware-weaponizes-screenconnect-sessions-to-compromise-msp-environments","SCKit Malware Weaponizes ScreenConnect Sessions to Compromise MSP Environments","2026-11-12T18:20:54.437+00:00",{"slug":60,"title":61,"published_at":62},"weak-sql-server-credentials-open-door-to-miners-and-rat","Weak SQL Server Credentials Open Door to Miners and RAT","2026-11-12T17:21:13.877+00:00",{"slug":64,"title":65,"published_at":66},"autonomous-ai-driven-attacks-breach-semiconductor-and-defense-targets","Autonomous AI-Driven Attacks Breach Semiconductor and Defense Targets","2026-11-12T16:21:21.535+00:00",[68,73,78,83,88,93],{"slug":69,"name":70,"problem":71,"stories":72},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",567,{"slug":74,"name":75,"problem":76,"stories":77},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",373,{"slug":79,"name":80,"problem":81,"stories":82},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",338,{"slug":84,"name":85,"problem":86,"stories":87},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",275,{"slug":89,"name":90,"problem":91,"stories":92},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",256,{"slug":94,"name":95,"problem":96,"stories":97},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",238,[99,105,111,116,121,126,131,136],{"family":100,"item":101,"code":102,"title":103,"together":104},"gdpr","32","Article 32","Security of processing",957,{"family":106,"item":107,"code":108,"title":109,"together":110},"nist-800-53","ac-2","AC-2","Account Management",956,{"family":5,"item":112,"code":113,"title":114,"together":115},"3","Control 3","Data Protection",550,{"family":106,"item":117,"code":118,"title":119,"together":120},"ac-6","AC-6","Least Privilege",474,{"family":5,"item":122,"code":123,"title":124,"together":125},"8","Control 8","Audit Log Management",370,{"family":127,"item":128,"code":129,"title":129,"together":130},"itil","overview","ITIL",369,{"family":106,"item":132,"code":133,"title":134,"together":135},"ac-3","AC-3","Access Enforcement",353,{"family":100,"item":137,"code":138,"title":139,"together":82},"25","Article 25","Data protection by design and by default"]