Identities and credentials for authorized users, services, and hardware are managed by the organization

Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records DE-0005 against IA-2 Identification and Authentication (Organizational Users), and CSF 2.0's own crosswalk names that control as an informative reference for PR.AA-01. Through SPARTA: SPARTA's catalog maps DE-0005 to countermeasure CM0035 Protect Authenticators, and that countermeasure's own CSF references include PR.AA-01. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15.

Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records EX-0011 against IA-2 Identification and Authentication (Organizational Users), and CSF 2.0's own crosswalk names that control as an informative reference for PR.AA-01. Through SPARTA: SPARTA's catalog maps EX-0011 to countermeasure CM0035 Protect Authenticators, and that countermeasure's own CSF references include PR.AA-01. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15.

Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records IA-0001.02 against IA-5 Authenticator Management, and CSF 2.0's own crosswalk names that control as an informative reference for PR.AA-01. Through SPARTA: SPARTA's catalog maps IA-0001.02 to countermeasure CM0001 Protect Sensitive Information, and that countermeasure's own CSF references include PR.AA-01. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15.