Skip to main content
MuonPartners
Services
Architecture

Solution design and technology roadmapping

Solution AssessmentTechnology RoadmapsIntegration DesignSolution ArchitectureTechnical Design
Cyber Security

Security assessments, IAM, and compliance

AssessmentsIAMComplianceSecurity BaselineCyber Innovation
Network and Platform

Network architecture and cloud platforms

Network DesignCloud StrategyModernisation
Enterprise Architecture

Business-technology alignment

Business AlignmentPortfolio AnalysisGovernance
View all services
ProjectsCase StudiesInsightsToolsAbout
Contact Us

Services

Architecture
Solution AssessmentTechnology RoadmapsIntegration DesignSolution ArchitectureTechnical Design
Cyber Security
AssessmentsIAMComplianceSecurity BaselineCyber Innovation
Network and Platform
Network DesignCloud StrategyModernisation
Enterprise Architecture
Business AlignmentPortfolio AnalysisGovernance
ProjectsCase StudiesInsightsToolsAboutContact
Get in Touch
MuonPartners

Strategic technology consulting for Australian organisations navigating complexity.

Services

  • Architecture
  • Cyber Security
  • Network and Platform
  • Enterprise Architecture

Company

  • About
  • Products
  • Frameworks
  • Cross-Framework Mapping
  • Projects
  • Case Studies
  • Insights
  • Contact

Contact

  • [email protected]
  • Australia
  • LinkedIn

© 2026 Muon Partners. All rights reserved.

ABN 50 669 022 315 · A Muon Group company.

Privacy PolicyTerms of Service
  1. Frameworks
  2. >AESCSF
  3. >ACCESS
  4. >Establish Identities And Manage Authentication
  5. >AESCSF-ACCESS-1b
AESCSF-ACCESS-1bActive

Credentials (such as passwords, smartcards, certificates, and keys) are issued for personnel and other entities that ...

Statement

Credentials (such as passwords, smartcards, certificates, and keys) are issued for personnel and other entities that require access to assets, at least in an ad hoc manner

Context and Guidance: Prior to giving personnel and other entities access to organisational assets, the organisation should issue credentials to prove that the individual requesting access has the necessary privileges to access the assets. Entities may include individuals (internal or external to the organisation) as well as devices, systems, or processes that require access to assets. The privileges associated with those credentials should be in line with the operational requirements.

Related Practices • Progression: This practice is part of a practice progression. Practice progressions are groups of related practices that represent increasingly complete or more advanced implementations of an activity. The practices in this progression include: ACCESS-1b, ACCESS-1d, ACCESS-1g, ACCESS-1h, ACCESS-1i.

Location

Domain
ACCESS
Objective
Establish Identities and Manage Authentication

Practice Details

Identifier
AESCSF-ACCESS-1b
Type
Practice
Domain
ACCESS
Objective
Establish Identities and Manage Authentication

Maturity Level

MIL-1MIL-2MIL-3

Security Profile

SP-1SP-2SP-3
ISM
ISM-1546relatedvia aescsf-reference
C2M2
C2M2-ACCESS-1Bequivalentvia derived-shared-practice-structure
ISO 27001
ISO27001-5.16relatedvia aescsf-reference
ISO27001-5.18relatedvia aescsf-reference
ISO27001-8.2relatedvia aescsf-reference
View in graphReport an issue
← Back to Establish Identities and Manage Authentication
Establish Identities and Manage Authentication10 controls
AESCSF-ACCESS-1aIdentities are provisioned, at least in an ad hoc manner, for personnel and other entities such as services and devic...AESCSF-ACCESS-1bCredentials (such as passwords, smartcards, certificates, and keys) are issued for personnel and other entities that ...AESCSF-ACCESS-1cIdentities are deprovisioned, at least in an ad hoc manner, when no longer requiredAESCSF-ACCESS-1dPassword strength and reuse restrictions are defined and enforcedAESCSF-ACCESS-1eIdentity repositories are reviewed and updated periodically and according to defined triggers, such as system changes...AESCSF-ACCESS-1fIdentities are deprovisioned within organisation-defined time thresholds when no longer requiredAESCSF-ACCESS-1gThe use of privileged credentials is limited to processes for which they are requiredAESCSF-ACCESS-1hStronger credentials, multifactor authentication, or single use credentials are required for higher risk access (such...AESCSF-ACCESS-1iMultifactor authentication is required for all access, where feasibleAESCSF-ACCESS-1jIdentities are disabled after a defined period of inactivity, where feasible