Authorization
What is Authorization?
The process of determining whether a user, program, or device is permitted to access a resource, perform an operation, or execute a command.
Terms that appear alongside authorization
Each of these is named in at least one of the same controls as authorization. The number is how many controls name both.
- authentication 43 shared controls
- nist 28 shared controls
- audit 28 shared controls
- fedramp 23 shared controls
- policy 21 shared controls
- access control 19 shared controls
- compliance 18 shared controls
- baseline 13 shared controls
Frameworks that govern authorization
What the standards actually require on authorization
Requirements naming authorization across 6 standards, quoted from the control text.
Authorize physical access to the facility where the system resides based on position or role.
NIST800-PE-2(1) · PE-2(1) Physical Access Authorizations | Access by Position or Role →A FedRAMP Authorized designation makes the package available on request to the whole federal government, but the initial agency ATO is not a government-wide risk acceptance: each subsequent agency reviews the package, determines the acceptability of the risks...
fedramp-rev-5::A.9 · A.9 Reuse: every agency issues its own authorization →Neither the PIN (personal identification number) nor the PIN block may be kept after authorization completes. Applicability: although PIN blocks are encrypted during normal transaction processing, re-encrypting a PIN block does not make it acceptable to store...
3.3.1.3 · 3.3.1.3 PIN and PIN block not retained after authorization →The organisation employs identity providers and authorization servers to manage identities, attributes and access rights of users, devices and non-person entities supporting authentication and authorization decisions in line with defined policy and mechanisms....
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::IA-13 · IA-13 Identity providers and authorization servers →Verify that individuals or systems transferring data between interconnecting systems have the requisite authorizations (i.e., write permissions or privileges) prior to accepting such data.
nist-sp-800-53-revision-5-1-high::CA-3(6) · CA-3(6) Information Exchange | Transfer Authorizations →a. Develop, approve, and maintain a list of individuals with authorized access to the facility where the system resides; b. Issue authorization credentials for facility access; c.
nist-sp-800-53-rev-5-moderate::PE-2 · PE-2 Physical Access Authorizations →Questions people ask about authorization
What is Authorization?
Why is Authorization important for compliance?
Which compliance frameworks address Authorization?
Where can I learn more about Authorization?
See how Authorization applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.