A.8.3 Technological
Information access restriction
Structured attributes from ISO/IEC 27002:2022 — control type · CIA properties · cybersecurity concept · operational capability · security domain. What do these mean?
The implementation guidance for this control is published in
ISO/IEC 27002:2022
and is not reproduced here. The structured attributes and the cross-walk
rationales below are derived facts and our own AI-authored analysis.
Mapped NIST 800-53 r5 controls (12)
Our AI-authored reading (authority llm_unverified, under review) of how this ISO control and each NIST 800-53 control relate. Not an ISO or NIST product.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- AC-3fullcovers — Both controls require the system to enforce access decisions that limit what subjects can do to objects based on policy-defined rules and attributes.
- AC-16mostlyaligns with — Dynamic access management in the ISO guidance relies on security and privacy attributes (identity, device, location, classification) to drive real-time enforcement decisions.
- AC-6mostlyaligns with — The ISO control’s emphasis on granting only the specific permissions (read, write, delete, execute) needed for each identity or group directly supports the principle of least privilege.
- AC-17partialaligns with — The ISO control’s rules for external or remote users and the use of dynamic techniques to restrict access outside the organization align with remote-access policy enforcement.
- AC-2partialaligns with — Managing which identities or groups receive which permissions is an integral part of account and privilege provisioning covered by account management.
- AC-4partialaligns with — The requirement to isolate sensitive applications and data and to control information flows between subjects and objects overlaps with information-flow-enforcement objectives.
Aligned NIST CSF 2.0 outcomes (11)
NIST CSF 2.0 outcomes this ISO control aligns with — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- PR.AA-05fullcovers — The ISO control's core requirement to define, enforce, and review access permissions and entitlements directly fulfills the CSF outcome of managing authorizations according to policy.
- PR.AA-01mostlyaligns with — By requiring authenticated identities and prohibiting anonymous access to sensitive information, the control supports the CSF outcome of managing identities and credentials for authorized users and services.
- PR.AA-03mostlyaligns with — The control's emphasis on authentication, credentials, and certificates before granting access aligns with the CSF outcome of authenticating users, services, and hardware.
- PR.AA-06partialaligns with — The control's call for physical or logical access controls to isolate sensitive systems and data partially addresses the CSF outcome of managing and monitoring physical access commensurate with risk.
- PR.DS-01partialaligns with — Dynamic access management techniques that use encryption and restrict printing or copying help protect the confidentiality and integrity of data-at-rest.
- PR.DS-02partialaligns with — Dynamic controls that enforce time-bound access and encryption during transmission contribute to protecting data-in-transit.
Related OWASP ASVS 5.0 requirements (14)
Application-security verification requirements (OWASP ASVS 5.0) this ISO control aligns with; links open the ASVS chapter. Our AI-authored analysis (authority llm_unverified, under review) — many ISO controls have no ASVS counterpart.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- V8.2.1mostlycovers — The ISO control's requirement to restrict function-level access according to established policies directly implements the ASVS mandate that applications enforce function-level authorization based on explicit consumer permissions.
- V8.2.2mostlycovers — By controlling which data items a given user or identity may access, the ISO guidance aligns with the ASVS requirement that applications restrict data-specific access to only those consumers holding explicit permissions for those items.
- V8.3.1mostlycovers — Requiring that access decisions be enforced through trusted configuration mechanisms and service-layer controls matches the ASVS rule that authorization must be performed at a trusted service layer rather than relying on untrusted client-side enforcement.
- V6.3.3partialaligns with — The ISO insistence that unknown or anonymous identities must not access sensitive information aligns with the ASVS requirement that sensitive operations be protected by multi-factor or combined single-factor authentication mechanisms.
- V8.2.3partialaligns with — The ISO emphasis on controlling read, write, delete and execute rights for identities or groups maps to the ASVS expectation that field-level access is limited to consumers with explicit permissions on those fields.
- V8.4.1partialaligns with — The ISO directive to isolate sensitive applications and data through physical or logical controls supports the ASVS requirement that multi-tenant applications implement cross-tenant controls to prevent one tenant from affecting others.
Related weaknesses / CWE (242)
Weakness classes this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
CWE-1057←PCWE-1083←P →PCWE-1191←P →PCWE-1220←M →PCWE-1230←P →PCWE-1231←PCWE-1244←P →PCWE-1256←P →PCWE-1257←P →PCWE-1259←P →MCWE-1260→PCWE-1262←P →PCWE-1268←P →PCWE-1272←PCWE-1274←P →PCWE-1280←P →PCWE-1299←P →PCWE-1323←P →MCWE-15←P →MCWE-178←PCWE-200→FCWE-202←P →MCWE-213←P →PCWE-214←P →PCWE-219←P →MCWE-22←P →PCWE-23→PCWE-24→PCWE-25→PCWE-266←P →PCWE-267→PCWE-268←P →PCWE-269→MCWE-27→PCWE-270←P →PCWE-272→PCWE-274←P →MCWE-277←PCWE-278←P →PCWE-279←PCWE-28←P →PCWE-280←PCWE-281←PCWE-282←PCWE-283←P →PCWE-284→FCWE-285→MCWE-286→PCWE-288←P →PCWE-289←P →PCWE-290←P →PCWE-291←P →PCWE-30→PCWE-302←P →PCWE-304←P →PCWE-305←P →PCWE-308←PCWE-314→PCWE-317←PCWE-32→PCWE-35→PCWE-36→PCWE-37→PCWE-378→PCWE-379→PCWE-38→PCWE-40←P →PCWE-402←P →FCWE-408←P →PCWE-412←P →PCWE-419←P →MCWE-420→MCWE-421←P →PCWE-424←P →MCWE-425←M →MCWE-441←PCWE-454→PCWE-471←P →PCWE-488←P →PCWE-507→PCWE-520←P →PCWE-524←P →MCWE-527←P →MCWE-528←P →PCWE-529←P →MCWE-530←P →MCWE-548←P →FCWE-551←P →PCWE-556←P →PCWE-564←PCWE-566←P →MCWE-57←P →PCWE-602→MCWE-603←P →PCWE-61←P →PCWE-610→PCWE-612←P →FCWE-62←P →PCWE-638←P →PCWE-639←P →MCWE-64→PCWE-642←P →MCWE-647←P →PCWE-65←P →MCWE-653←P →PCWE-654←P →PCWE-669←P →PCWE-671←PCWE-673←PCWE-689←P →PCWE-69←P →PCWE-706←P →PCWE-708←P →PCWE-73→PCWE-732→MCWE-749←P →PCWE-767←PCWE-782←P →PCWE-784←P →MCWE-807→PCWE-837←PCWE-842→PCWE-862→MCWE-863→PCWE-915→PCWE-921←P →MCWE-926←P →MCWE-939←P →MCWE-99→P
Why these map — AI rationale (under review)
- CWE-200fullprevents — Restricting anonymous or unknown access and encrypting high-value information limits the exposure of sensitive data that would otherwise be obtainable by unauthorized actors.
- CWE-284fullprevents — By enforcing explicit rules on which identities or groups may perform read, write, delete or execute operations and by denying anonymous access to sensitive data, the control directly stops the creation of overly permissive or missing access-control checks.
- CWE-402fullprevents — Information-access-restriction directly prevents private resources from being exposed beyond intended boundaries.
- CWE-548fullprevents — Information access restriction directly prevents directory listings by enforcing need-to-know access controls on web resources.
- CWE-612fullprevents — Information access restriction is the technical mechanism that prevents unauthorized index queries.
- CWE-1259mostlyprevents — Information access restriction directly limits which entities can obtain or use security tokens.
- CWE-1323mostlyprevents — Technical access restrictions directly prevent unauthorized access to trace storage.
- CWE-15mostlyprevents — Information access restriction limits who can view or modify configuration data.
- CWE-202mostlyprevents — Information access restriction directly limits query scope that could lead to inference.
- CWE-219mostlymitigates — Technical access restrictions can block direct HTTP access to sensitive files under the web root.
- CWE-269mostlyprevents — Dynamic techniques that grant the minimum necessary rights for a given time window and revoke them afterward reduce the window in which excessive or unnecessary privileges can be exploited.
- CWE-274mostlyprevents — Information-access-restriction mechanisms enforce least-privilege checks that mitigate the weakness at runtime.
- CWE-285mostlyprevents — Granular, policy-driven assignment of permissions and dynamic enforcement of those permissions prevent the incorrect or missing authorization decisions that lead to improper authorization flaws.
- CWE-419mostlyprevents — Information access restriction limits exposure of the unprotected primary channel.
- CWE-420mostlyprevents — Access restrictions may cover primary paths but leave alternate channels unprotected unless explicitly extended.
- CWE-424mostlyprevents — Information access restriction mechanisms must close all alternate paths to restricted data or functions.
- CWE-425mostlyprevents — Information access restriction implements the technical enforcement that directly blocks unauthorized direct requests.
- CWE-524mostlyprevents — Information access restriction directly limits who can read cached sensitive data.
- CWE-527mostlyprevents — Information access restriction mechanisms limit repository exposure to authorized users only.
- CWE-529mostlyprevents — Information access restriction explicitly prevents unauthorized actors from reaching ACL files.
- CWE-530mostlyprevents — Information-access-restriction rules can be applied to backup directories or archives to block unauthorized spheres.
- CWE-566mostlyprevents — Enforcing information-access restrictions prevents direct use of user-supplied primary keys to bypass authorization checks.
- CWE-602mostlyprevents — Information access restriction is undermined when the client is trusted to enforce it.
- CWE-639mostlyprevents — Information access restriction explicitly enforces that users may only retrieve data they are authorized to see, directly addressing user-controlled key bypass.
- CWE-642mostlyprevents — Information access restriction mechanisms enforce least-privilege access to critical state.
- CWE-65mostlyprevents — Access-control rules can restrict which files a process may open, limiting the impact of hard-link redirection.
- CWE-732mostlyprevents — Requiring explicit configuration of access controls and permissions for files, applications and services counters the assignment of overly permissive default or incorrect file-system rights.
- CWE-784mostlyprevents — Information access restriction requires proper validation of identity tokens before granting access.
- CWE-862mostlyprevents — Requiring authentication and credentials before any access occurs eliminates the absence of authorization checks that would otherwise allow an unauthenticated actor to reach protected resources.
- CWE-921mostlyprevents — Information-access-restriction control directly enforces access controls on stored sensitive data.
- CWE-926mostlyprevents — Enforcing information-access restrictions on exported Android components directly prevents unauthorized launch or data access.
- CWE-939mostlyprevents — Enforces explicit authorization checks on which actors may invoke handlers, directly addressing the missing restriction on custom-URL-scheme access.
- CWE-1083partialmitigates — Enforcing information access restriction through a designated data manager directly prevents bypasses that constitute CWE-1083.
- CWE-1191partialmitigates — Information-access-restriction principles directly map to enforcing authorization on debug/test registers.
- CWE-1220partialprevents — Directly requires information-access restriction at the level of individual assets and operations, addressing the granularity gap.
- CWE-1230partialprevents — Information-access-restriction mechanisms can be applied to metadata, but the control focuses on primary data.
- CWE-1244partialmitigates — Information access restriction can reduce exposure of internal assets but does not cover physical debug port access levels.
- CWE-1256partialmitigates — Information access restriction can enforce least-privilege access to hardware feature APIs, mitigating the risk of side-channel or memory/register tampering.
- CWE-1257partialprevents — Enforcing information access restrictions on memory-mapped regions directly mitigates inconsistent alias permissions.
- CWE-1260partialmitigates — Information access restriction policies rely on correct memory protection; eliminating overlap strengthens enforcement but does not define the policy.
- CWE-1262partialprevents — Information access restriction explicitly limits software access to memory-mapped register interfaces.
- CWE-1268partialprevents — Implements technical restrictions on information access that can prevent inconsistent privilege enforcement.
- CWE-1274partialprevents — Information access restriction directly addresses unauthorized access to volatile memory holding boot code.
- CWE-1280partialprevents — Enforces access restrictions before asset use, directly addressing the timing flaw.
- CWE-1299partialprevents — Information access restriction mandates controls on every path to protected assets, mitigating bypass via shadow or external interfaces.
- CWE-213partialmitigates — Technical access restrictions can enforce the stricter policy when policies conflict.
- CWE-214partialmitigates — Information access restriction limits visibility of process arguments and environment variables to authorized users only.
- CWE-22partialmitigates — Information access restriction limits which files an application may read or write.
- CWE-23partialmitigates — Information access restriction limits which files can be reached, mitigating impact but not preventing the traversal flaw.
- CWE-24partialmitigates — Information access restriction limits which files can be reached, mitigating impact of traversal.
- CWE-25partialmitigates — Information access restriction limits which directories users or processes may traverse.
- CWE-266partialprevents — Information-access-restriction mechanisms enforce the correct privilege boundaries once assignment rules are defined.
- CWE-267partialmitigates — Information access restriction limits what privileged users can do but does not prevent unsafe actions inherent in the privilege.
- CWE-268partialprevents — Information access restriction limits the ability to combine privileges for unsafe actions.
- CWE-27partialmitigates — Information access restriction can limit which files are reachable, reducing impact but not preventing the traversal vector.
- CWE-270partialprevents — Information-access-restriction rules help limit privileges but do not cover dynamic switching errors.
- CWE-272partialmitigates — Information access restriction supports least privilege but does not specifically mandate dropping rights after privileged operations.
- CWE-278partialprevents — Information access restriction mechanisms can enforce least-privilege checks during object creation or archive extraction.
- CWE-28partialmitigates — Information access restriction limits which directories users or processes may reach, reducing traversal impact.
- CWE-283partialmitigates — Information access restriction mechanisms can implement ownership checks before allowing operations on protected resources.
- CWE-286partialmitigates — Information access restriction depends on properly managed users but does not address user management itself.
- CWE-288partialprevents — Information access restriction enforces authentication on every interface and channel.
- CWE-289partialprevents — Information-access-restriction mechanisms can implement canonical-name checks to prevent bypass.
- CWE-290partialprevents — Information access restriction relies on proper authentication but does not implement it.
- CWE-291partialprevents — Information-access-restriction mechanisms must authenticate subjects before granting access.
- CWE-30partialmitigates — Information access restriction limits which files can be reached, indirectly reducing impact of traversal.
- CWE-302partialmitigates — Technical access-restriction mechanisms can enforce server-side validation instead of trusting client-supplied data.
- CWE-304partialmitigates — Limits access based on proper authentication; incomplete auth weakens the restriction.
- CWE-305partialmitigates — Information access restriction complements authentication by limiting what can be reached even if bypass occurs.
- CWE-314partialmitigates — Access restrictions limit who can read the registry key but leave the data unencrypted.
- CWE-32partialprevents — Information-access-restriction policies limit which files can be reached, mitigating impact but not the traversal vector itself.
- CWE-35partialmitigates — Information access restriction limits file reachability but does not address the input-validation flaw itself.
- CWE-36partialmitigates — Information access restriction limits which files can be reached but does not address the path-construction flaw itself.
- CWE-37partialmitigates — Access-control rules can limit which files an authenticated user may reach, mitigating impact of traversal.
- CWE-378partialprevents — Information access restriction can limit exposure but does not address file creation itself.
- CWE-379partialmitigates — Information access restriction policies can limit who may read or list files in shared temporary directories.
- CWE-38partialmitigates — Information-access-restriction rules limit which files an application may touch, mitigating impact of traversal.
- CWE-40partialmitigates — Information access restriction policies can limit which UNC paths users or processes may reach.
- CWE-408partialprevents — Information access restriction mechanisms can block resource-intensive operations until authentication succeeds.
- CWE-412partialmitigates — Information access restriction directly prevents unauthorized external actors from controlling locks.
- CWE-421partialprevents — Restricting information access helps ensure alternate channels are only reachable by authorized users.
- CWE-454partialmitigates — Information access restriction limits who can modify data stores but does not address initialization logic.
- CWE-471partialmitigates — Access-control rules directly prevent unauthorized modification of data assumed to be immutable.
- CWE-488partialmitigates — Information access restriction directly enforces session boundaries so data is not exposed to the wrong session.
- CWE-507partialmitigates — Information access restriction limits exposure to Trojan Horse code but does not prevent its existence.
- CWE-520partialmitigates — Enforcing information-access restrictions prevents .NET code from obtaining the elevated file/OS rights that impersonation would otherwise allow.
- CWE-528partialprevents — Information-access-restriction mechanisms can directly block unauthorized reads of core-dump files.
- CWE-551partialmitigates — Information access restriction is undermined when authorization occurs before canonicalization.
- CWE-556partialmitigates — Information access restriction ensures impersonated identities receive only the minimum necessary privileges.
- CWE-57partialprevents — Enforces access-control rules on files and directories, directly blocking unauthorized path traversal.
- CWE-603partialmitigates — Enforces access restrictions that must be validated on the server, mitigating client-side bypass.
- CWE-61partialmitigates — Access-control rules can restrict which files a process may open, reducing symlink-following risk but not eliminating the underlying path-resolution flaw.
- CWE-610partialmitigates — Information access restriction limits what resources can be reached, indirectly reducing impact of external references.
- CWE-62partialmitigates — Access-control rules can restrict which files a process may open, reducing the chance of following unauthorized hard links.
- CWE-638partialprevents — Information access restriction enforces checks on every resource access.
- CWE-64partialprevents — Information access restriction can limit the impact of unauthorized file operations triggered by malicious shortcuts.
- CWE-647partialprevents — Enforcing strict access-control rules on canonical resource identifiers directly prevents authorization bypass via non-canonical URLs.
- CWE-653partialmitigates — Information access restriction implements the technical enforcement of compartmentalization.
- CWE-654partialprevents — Information access restriction can require multi-factor checks, yet the control is wider than authentication.
- CWE-669partialmitigates — Information-access restrictions help enforce sphere boundaries.
- CWE-689partialprevents — Enforces access restrictions on resources, reducing exposure during copy operations.
- CWE-69partialmitigates — Access-control rules can restrict which users or processes may read or write alternate data streams, but do not inherently detect or block ADS misuse.
- CWE-706partialmitigates — Access-control rules can restrict which names/references a subject may resolve, limiting the impact of incorrect resolution.
- CWE-708partialprevents — Information-access-restriction mechanisms rely on correct ownership; eliminating incorrect ownership strengthens this control.
- CWE-73partialmitigates — Information access restriction limits which files can be reached, indirectly reducing impact of path manipulation.
- CWE-749partialprevents — Information access restriction can prevent external actors from reaching dangerous functions, yet does not remove the function.
- CWE-782partialprevents — Information access restriction enforces the access-control checks missing from the IOCTL.
- CWE-807partialprevents — Access-control rules can be bypassed if they rely on untrusted inputs.
- CWE-842partialprevents — Information access restriction is enforced via groups, but the control addresses restriction mechanisms, not membership correctness.
- CWE-863partialprevents — By tying access rights to identity, device, location and classification, the control reduces the likelihood that an authorization decision will be based on an incorrect or bypassed policy.
- CWE-915partialprevents — Information access restriction limits who can modify objects but does not address which attributes may be changed.
- CWE-99partialmitigates — Information-access-restriction policies limit which resources can be referenced, indirectly reducing injection impact.
- CWE-1057nonenone — Enforces data-access restrictions through defined interfaces, reducing bypass of the central data manager.
- CWE-118nonenone — Information access restriction limits who can access data but does not prevent index-based range errors within allowed access.
- CWE-1189nonenone — Information access restriction can limit software-level access to shared SoC resources but does not address hardware isolation.
- CWE-1231nonemitigates — Information access restriction can restrict write access to lock-bit registers, yet does not guarantee the bit cannot be altered after being set.
- CWE-1272nonemitigates — Access-restriction mechanisms can enforce clearing of data when privileges change, but do not mandate the clearing itself.
- CWE-1386nonemitigates — Information access restriction reduces exposure but does not prevent the technical flaw itself.
- CWE-178nonenone — Access-control rules that ignore case can allow unintended resource access.
- CWE-26nonenone — Information access restriction limits which files can be reached, mitigating impact but not the root cause.
- CWE-271nonemitigates — Information access restriction policies can limit privilege scope but do not specifically address dropping privileges at runtime.
- CWE-277nonemitigates — Information access restriction policies can reduce risk from inherited permissions but do not enforce secure permission inheritance at creation time.
- CWE-279nonemitigates — Information access restriction policies limit the permissions that executing code can grant or modify.
- CWE-280nonenone — Enforces information-access restrictions that should catch insufficient-privilege conditions.
- CWE-281nonenone — Information-access-restriction controls enforce least-privilege permissions that must be preserved during copy/restore operations.
- CWE-282nonemitigates — Information access restriction mechanisms rely on correct ownership to enforce access decisions.
- CWE-308nonenone — Information access restriction can enforce MFA, yet the control is wider than authentication mechanisms.
- CWE-309nonenone — Information access restriction relies on prior authentication; does not mitigate password flaws.
- CWE-317nonemitigates — Access restriction limits who sees the GUI, but does not address cleartext storage itself.
- CWE-349nonenone — Information access restriction limits who can supply data but does not address validation of data origin or trust level.
- CWE-39nonenone — Information access restriction limits file reach but does not address malformed path inputs.
- CWE-403nonenone — Information access restriction policies may limit which processes can use descriptors, but do not address the leak itself.
- CWE-41nonenone — Information access restriction limits what files can be reached, indirectly reducing impact of path-equivalence exploits.
- CWE-441nonenone — Information-access-restriction mechanisms can enforce that requests retain and are checked against original source identity.
- CWE-470nonenone — Access restrictions limit who can supply the malicious input but do not address the reflection flaw itself.
- CWE-472nonenone — Information access restriction can limit which parameters users may influence, providing a secondary layer of defense.
- CWE-473nonenone — Information access restriction limits what data users can reach, indirectly reducing impact of tampered variables.
- CWE-50nonenone — Information access restriction can limit damage from path traversal but does not prevent the weakness itself.
- CWE-501nonenone — Information access restriction limits who sees data but does not prevent mixing trusted and untrusted data within structures.
- CWE-59nonemitigates — Access-control rules can limit which files are reachable, reducing exposure to malicious links.
- CWE-620nonenone — Information access restriction can be strengthened by password verification, yet the control focuses on access rights rather than change procedures.
- CWE-671nonenone — Information access restriction mechanisms allow administrators to set and modify access rules for the environment.
- CWE-673nonemitigates — Information access restrictions help prevent external modification of control boundaries.
- CWE-767nonenone — Information access restriction directly prevents public methods from exposing private variables.
- CWE-837nonenone — Information-access-restriction mechanisms can implement single-action limits, but the control covers broader access-restriction needs.
- CWE-90nonenone — Information access restriction limits who can query LDAP but does not address how queries are built.
- CWE-914nonenone — Information access restriction limits variable scope but does not address dynamic identification itself.
- CWE-98nonenone — Information access restriction limits what files can be read but does not address dynamic inclusion logic.
Mitigated MITRE ATT&CK techniques (6)
Adversary techniques (MITRE ATT&CK Enterprise) this ISO control helps mitigate; links open attack.mitre.org. Our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- T1021mostlyprevents — Enforcing explicit read/write/execute rights and device or location checks on remote services makes it harder for an adversary to abuse RDP, SMB shares, or similar channels with stolen credentials.
- T1078mostlyprevents — Requiring authenticated, non-anonymous identities and enforcing per-user or per-group permissions directly prevents adversaries from leveraging stolen or default credentials to gain unauthorized access.
- T1213mostlyprevents — Enforcing per-user read/write controls and encryption on information repositories limits the data an adversary who has gained a foothold can silently collect from collaboration platforms or databases.
- T1530mostlyprevents — Granular, time-bound, and identity-based restrictions on cloud storage objects reduce the ability of compromised accounts to freely enumerate or exfiltrate data from cloud repositories.
- T1087partialprevents — By tying access to verified identities and groups rather than anonymous or broad permissions, the control shrinks the attack surface that account-discovery techniques rely on to map usable targets.
- T1550partialmitigates — Dynamic access controls that bind permissions to specific identities, devices, or certificates limit the usefulness of harvested tokens or cookies for lateral movement.
Prevented OWASP Web Top 10 (2025) risks (4)
OWASP Web Top 10 (2025) risk categories this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- A01fullprevents — By enforcing identity-based rules that limit which users or groups can read, write, delete or execute specific data, the control directly stops unauthorized subjects from reaching resources they should never touch.
- A02mostlyprevents — Mandating explicit configuration mechanisms and denying anonymous access prevents the default-open or overly permissive settings that commonly produce security misconfiguration.
- A04partialmitigates — Requiring encryption for high-value information throughout its life cycle limits exposure even if other controls fail, thereby reducing the impact of any cryptographic shortcomings.
- A07partialmitigates — Requiring authentication or certificates before any access occurs reduces the likelihood that weak or missing authentication will be exploited to reach protected information.
Control IDs, short titles and the structured attribute table (control type, CIA properties, cybersecurity-concept, operational capability, security domain) are facts from ISO/IEC 27001:2022 Annex A / ISO/IEC 27002:2022. The full implementation guidance prose lives in ISO/IEC 27002:2022 — not reproduced here. Cross-walks to NIST 800-53, NIST CSF 2.0, OWASP ASVS, CWE, MITRE ATT&CK and OWASP Web Top 10 are our own AI-authored analysis (authority llm_unverified, under review), not an ISO, NIST, MITRE or OWASP product — how ours compare.