[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-csf\u002Fpr-aa":3},{"item":4,"lessons":16,"controls":67,"related":97},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nist-csf","pr-aa","PR.AA-01","PR.AA: Identity Management, Authentication, and Access Control",3,"US National Institute of Standards and Technology (NIST)","**What it asks for.** This category expects access to physical and logical assets to be limited to authorised users, services and hardware, and managed in proportion to the assessed risk of unauthorised access. It covers identity and credential lifecycle, authentication, identity proofing, access permissions and physical access.\n\n**In practice.** Good practice is a single authoritative identity source, joiner, mover and leaver processes tied to HR records, and phishing-resistant multi-factor authentication for remote, privileged and high-risk access. Permissions follow least privilege and separation of duties, privileged accounts are managed and monitored, and service accounts and machine identities have owners. Access reviews are performed on a schedule with documented outcomes. Auditors will expect identity governance reports, MFA coverage figures, privileged access records, recertification evidence and physical access logs.\n\n**Common gaps.** Common weaknesses are orphaned accounts after people leave, unmanaged service and API credentials, and MFA gaps on legacy systems. Access reviews often become rubber-stamping exercises with little real scrutiny.",null,"https:\u002F\u002Fwww.nist.gov\u002Fcyberframework","Open the Cybersecurity Framework at NIST","2026-10-18T15:18:43.664+00:00",{"total":17,"list":18},1485,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"stolen-credential-exposes-apify-customer-data-highlighting-mfa-and-secrets-management-gaps","Stolen Credential Exposes Apify Customer Data, Highlighting MFA and Secrets Management Gaps","2026-11-13T13:20:22.45+00:00",{"slug":24,"title":25,"published_at":26},"compromised-github-accounts-weaponized-to-poison-thousands-of-repositories","Compromised GitHub Accounts Weaponized to Poison Thousands of Repositories","2026-11-13T10:20:30.167+00:00",{"slug":28,"title":29,"published_at":30},"north-korean-social-engineering-nets-billions-from-crypto-exchange","North Korean Social Engineering Nets Billions From Crypto Exchange","2026-11-13T03:20:21.598+00:00",{"slug":32,"title":33,"published_at":34},"self-hosted-ai-agents-demand-rigorous-credential-and-configuration-controls","Self-Hosted AI Agents Demand Rigorous Credential and Configuration Controls","2026-11-12T19:21:17.711+00:00",{"slug":36,"title":37,"published_at":38},"stealc-takedown-exposes-millions-of-stolen-credentials-from-everyday-users","StealC Takedown Exposes Millions of Stolen Credentials From Everyday Users","2026-11-12T17:21:32.836+00:00",{"slug":40,"title":41,"published_at":42},"zero-day-bypasses-n-central-patch-exposing-root-access-on-managed-servers","Zero-Day Bypasses N-central Patch, Exposing Root Access on Managed Servers","2026-11-12T17:20:56.853+00:00",{"slug":44,"title":45,"published_at":46},"hijacked-university-email-account-used-to-send-mass-bomb-hoaxes-across-europe","Hijacked University Email Account Used to Send Mass Bomb Hoaxes Across Europe","2026-11-12T15:21:00.033+00:00",{"slug":48,"title":49,"published_at":50},"factory-reset-restores-default-root-credentials-in-lenovo-server-firmware","Factory Reset Restores Default Root Credentials in Lenovo Server Firmware","2026-11-12T14:22:14.756+00:00",{"slug":52,"title":53,"published_at":54},"ai-pentesting-tool-abused-to-steal-aws-credentials-and-access-cloud-secrets","AI Pentesting Tool Abused to Steal AWS Credentials and Access Cloud Secrets","2026-11-12T12:20:40.179+00:00",{"slug":56,"title":57,"published_at":58},"unauthenticated-token-takeover-exposes-private-container-registries","Unauthenticated Token Takeover Exposes Private Container Registries","2026-11-12T10:21:30.989+00:00",{"slug":60,"title":61,"published_at":62},"stolen-cicd-credentials-enable-mass-github-repository-compromise","Stolen CI\u002FCD Credentials Enable Mass GitHub Repository Compromise","2026-11-12T10:21:13.379+00:00",{"slug":64,"title":65,"published_at":66},"stolen-github-credentials-enable-mass-ci-secret-theft-across-61000-repositories","Stolen GitHub Credentials Enable Mass CI Secret Theft Across 61,000 Repositories","2026-11-12T09:20:57.681+00:00",[68,73,77,82,87,92],{"slug":69,"name":70,"problem":71,"stories":72},"patch-management","Automated patch management","Known holes get closed in days, not months.",456,{"slug":74,"name":75,"problem":76,"stories":72},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":78,"name":79,"problem":80,"stories":81},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",451,{"slug":83,"name":84,"problem":85,"stories":86},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",245,{"slug":88,"name":89,"problem":90,"stories":91},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",236,{"slug":93,"name":94,"problem":95,"stories":96},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",151,[98,104,110,116,122,127,133,139],{"family":99,"item":100,"code":101,"title":102,"together":103},"nist-800-53","si-2","SI-2","Flaw Remediation",1401,{"family":105,"item":106,"code":107,"title":108,"together":109},"iso-27001","a-8-8","Annex A 8.8","ISO\u002FIEC 27001:2022 Annex A 8.8: Management of technical vulnerabilities",1323,{"family":111,"item":112,"code":113,"title":114,"together":115},"nis2","21-2-b","Article 21(2)(b)","Incident handling (Article 21(2)(b))",1125,{"family":117,"item":118,"code":119,"title":120,"together":121},"cis","7","Control 7","Continuous Vulnerability Management",779,{"family":117,"item":123,"code":124,"title":125,"together":126},"17","Control 17","Incident Response Management",696,{"family":128,"item":129,"code":130,"title":131,"together":132},"owasp","top10-2021-a06","A06:2021","A06:2021 Vulnerable and Outdated Components",663,{"family":134,"item":135,"code":136,"title":137,"together":138},"mitre-attack","t1566","T1566","Phishing",601,{"family":117,"item":140,"code":141,"title":142,"together":143},"14","Control 14","Security Awareness and Skills Training",472]