PR.AA-01 PR · Protect · PR.AA Identity Management, Authentication, and Access Control

PR.AA-01 — Identity and credential management

Identities and credentials for authorized users, services, and hardware are managed by the organization.

Also written as PR-AA-01, PR.AA-1, CSF 2.0 PR.AA-01, NIST CSF PR.AA.

Written by Jett N. · Last reviewed

What NIST CSF PR.AA-01 means

PR.AA-01 is one of 22 subcategories in the Protect (PR) function, under the Identity Management, Authentication, and Access Control category (PR.AA). The Core states: “Identities and credentials for authorized users, services, and hardware are managed by the organization.” Protect outcomes are where most existing security spend already sits, so the usual gap is not the absence of a control but the absence of evidence that it covers the whole estate rather than the parts that were easy.

Evidence that supports PR.AA-01

To demonstrate this outcome in an assessment or audit, gather artefacts such as:

  • IAM lifecycle procedures (joiner / mover / leaver)
  • Automated provisioning / deprovisioning records
  • Credential issuance and revocation logs for users, services and devices

How to implement PR.AA-01

  1. Cover users, services and hardware, not just peopleThe outcome names all three explicitly. Service accounts, API keys, workload identities and device certificates are identities under PR.AA-01, and they are typically the least managed — long-lived, broadly privileged and unowned.
  2. Automate the lifecycle from an authoritative sourceHR for staff, a contract system for contractors, and infrastructure-as-code for workloads. Manual identity lifecycle is where the orphaned accounts come from, and orphaned accounts are the observable symptom assessors look for.
  3. Set credential lifetimes and rotateStatic, non-expiring API keys are the most common weakness under this outcome. Prefer short-lived, automatically rotated credentials; where that is not possible, record the rotation schedule and evidence it happening.
  4. Keep issuance and revocation logsThe evidence for this outcome is the log — who was issued what, when, and when it was revoked. If credential issuance happens in several places, consolidating it is worth more than improving any individual process.
  5. Hunt for orphans routinelyA scheduled query for accounts with no owner, no recent authentication, or no corresponding HR record turns a periodic audit finding into a maintained state.

Common assessment findings for PR.AA-01

What actually gets raised against PR.AA-01, in rough order of how often it comes up:

Assessing PR.AA-01 in a profile

PR.AA-01 maps cleanly to ISO 27001 A.5.16 and A.5.17 and to SOC 2 CC6.1 to CC6.3. If you are running more than one framework, this is one of the highest-reuse evidence sets available — build it once and it serves all three.

ISO 27001 mapping

PR.AA-01 corresponds to the following ISO 27001:2022 Annex A control(s): A.5.16, A.5.17, A.5.18. Evidence collected for one framework typically supports the other.

Map PR.AA-01 to ISO 27001 & SOC 2 →
Crosswalk this subcategory in the Control Mapper & Gap Assessment.
Document the risk →
Record treatment for gaps against PR.AA-01 in the Risk Register.

Other Identity Management, Authentication, and Access Control subcategories

PR.AA-02 Identity proofing PR.AA-03 Authentication of users, services and hardware PR.AA-04 Identity assertion protection PR.AA-05 Access authorization and least privilege PR.AA-06 Physical access management

All 22 Protect subcategories →

Frequently asked questions

Is NIST CSF PR.AA-01 mandatory?

No. CSF 2.0 is a voluntary framework of outcomes rather than a set of requirements, and there is no certification against it. PR.AA-01 becomes binding only when something else makes it so — a contract, a regulator that references CSF, or your own Target Profile. That is the practical difference between CSF and an auditable standard like ISO 27001 or SOC 2.

How is PR.AA-01 assessed?

Through profiles rather than pass/fail testing. You record how fully the outcome is achieved today in a Current Profile, state where it needs to be in a Target Profile, and the gap between them becomes your action plan. Implementation Tiers (Partial, Risk Informed, Repeatable, Adaptive) describe how rigorous your governance around the outcome is, not whether you have met it.

Who owns PR.AA-01?

The Protect function is normally owned by the security or IT function, but PR.AA-01 still needs a specific named owner. Assessors treat an outcome with no owner as not achieved regardless of the tooling behind it, so record ownership in your profile alongside the assessment.

Does NIST CSF PR.AA-01 map to ISO 27001?

Yes — PR.AA-01 corresponds to ISO 27001:2022 Annex A control(s) A.5.16, A.5.17, A.5.18. Evidence collected for one framework typically supports the other, so a single control library can serve both.

What are the most common audit findings for PR.AA-01?

Non-human identities entirely outside the lifecycle process, with no owner and no rotation. Orphaned accounts belonging to former staff or decommissioned services still active.