Law / Frameworks / NIST CSF 2.0 / Protect

NIST CSF 2.0, ProtectPR.AA-01

Identities and credentials for authorized users, services, and hardware are managed by the organizationNIST Cybersecurity Framework, version 2.0, February 2024 (NIST CSWP 29), PR.AA-01

We read each law below as bearing on this control. That does not mean the control, done well, meets the law: what each law asks is on its own page. Law library as of 19 Oct 2026.

2: laws
2: jurisdictions
0: with court rulings behind them
0: not yet in force

Related controls in other frameworks the same duties, in at least two laws we track, reach both

NIST Privacy FrameworkPR.AC-P1 Identities and credentials are issued, managed, verified, revoked, and..., 2 laws

Sector security regimes

2 laws, 2 jurisdictions

Jurisdiction	Law	What it asks, as read here
European Union	Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication	Adopt measures that mitigate the risk that authentication elements categorized as knowledge are uncovered by or disclosed to unauthorized parties, that elements categorized as possession are used by or replicated for unauthorized parties, and that elements categorized as inherence and read by access devices and software are uncovered by unauthorized parties, with a very low probability of an unauthorized party being authenticated as the payer. Ensure that the breach of one element does not compromise the reliability of the others, and where an element is used through a multi-purpose device, use separated secure execution environments and mechanisms to ensure the software or device has not been altered (Articles 6 to 9). Ensure the confidentiality and integrity of the personalized security credentials of the payment service user, including authentication codes, during all phases of the authentication: mask them when displayed, do not store them or the related cryptographic material in plain text, protect secret cryptographic material from unauthorized disclosure, document the management of the cryptographic material, and process and route credentials and codes in secure environments in accordance with strong and widely recognized industry standards (Article 22).
New York	New York Department of Financial Services Cybersecurity Regulation, Access Privileges and Management	If you use passwords as a method of authentication, implement a written password policy that meets industry standards.

Jurisdiction

Law

What it asks, as read here

European Union

Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication

Adopt measures that mitigate the risk that authentication elements categorized as knowledge are uncovered by or disclosed to unauthorized parties, that elements categorized as possession are used by or replicated for unauthorized parties, and that elements categorized as inherence and read by access devices and software are uncovered by unauthorized parties, with a very low probability of an unauthorized party being authenticated as the payer. Ensure that the breach of one element does not compromise the reliability of the others, and where an element is used through a multi-purpose device, use separated secure execution environments and mechanisms to ensure the software or device has not been altered (Articles 6 to 9).

Ensure the confidentiality and integrity of the personalized security credentials of the payment service user, including authentication codes, during all phases of the authentication: mask them when displayed, do not store them or the related cryptographic material in plain text, protect secret cryptographic material from unauthorized disclosure, document the management of the cryptographic material, and process and route credentials and codes in secure environments in accordance with strong and widely recognized industry standards (Article 22).

New York

New York Department of Financial Services Cybersecurity Regulation, Access Privileges and Management

If you use passwords as a method of authentication, implement a written password policy that meets industry standards.

Full text of the NIST Cybersecurity Framework, public domain (a US government work). Every control of the framework.