Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties

Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records DE-0006 against AC-3 Access Enforcement, and CSF 2.0's own crosswalk names that control as an informative reference for PR.AA-05. Through SPARTA: SPARTA's catalog maps DE-0006 to countermeasure CM0039 Least Privilege, and that countermeasure's own CSF references include PR.AA-05. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15. PR.AA-05 is one of CSF's broader outcomes, so this edge locates the technique within CSF's structure rather than naming a specific defence.

Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records EX-0005.02 against AC-3 Access Enforcement; AC-6 Least Privilege, and CSF 2.0's own crosswalk names that control as an informative reference for PR.AA-05. Through SPARTA: SPARTA's catalog maps EX-0005.02 to countermeasure CM0043 Backdoor Commands, and that countermeasure's own CSF references include PR.AA-05. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15. PR.AA-05 is one of CSF's broader outcomes, so this edge locates the technique within CSF's structure rather than naming a specific defence.

Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records EX-0006 against AC-3 Access Enforcement, and CSF 2.0's own crosswalk names that control as an informative reference for PR.AA-05. Through SPARTA: SPARTA's catalog maps EX-0006 to countermeasure CM0043 Backdoor Commands, and that countermeasure's own CSF references include PR.AA-05. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15. PR.AA-05 is one of CSF's broader outcomes, so this edge locates the technique within CSF's structure rather than naming a specific defence.

Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records EX-0012 against AC-3 Access Enforcement, and CSF 2.0's own crosswalk names that control as an informative reference for PR.AA-05. Through SPARTA: SPARTA's catalog maps EX-0012 to countermeasure CM0038 Segmentation; CM0039 Least Privilege, and that countermeasure's own CSF references include PR.AA-05. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15. PR.AA-05 is one of CSF's broader outcomes, so this edge locates the technique within CSF's structure rather than naming a specific defence.

Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records EX-0012.01 against AC-3 Access Enforcement, and CSF 2.0's own crosswalk names that control as an informative reference for PR.AA-05. Through SPARTA: SPARTA's catalog maps EX-0012.01 to countermeasure CM0038 Segmentation; CM0039 Least Privilege, and that countermeasure's own CSF references include PR.AA-05. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15. PR.AA-05 is one of CSF's broader outcomes, so this edge locates the technique within CSF's structure rather than naming a specific defence.

Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records EX-0012.02 against AC-3 Access Enforcement, and CSF 2.0's own crosswalk names that control as an informative reference for PR.AA-05. Through SPARTA: SPARTA's catalog maps EX-0012.02 to countermeasure CM0038 Segmentation; CM0039 Least Privilege, and that countermeasure's own CSF references include PR.AA-05. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15. PR.AA-05 is one of CSF's broader outcomes, so this edge locates the technique within CSF's structure rather than naming a specific defence.

Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records EX-0012.03 against AC-3 Access Enforcement, and CSF 2.0's own crosswalk names that control as an informative reference for PR.AA-05. Through SPARTA: SPARTA's catalog maps EX-0012.03 to countermeasure CM0038 Segmentation; CM0039 Least Privilege, and that countermeasure's own CSF references include PR.AA-05. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15. PR.AA-05 is one of CSF's broader outcomes, so this edge locates the technique within CSF's structure rather than naming a specific defence.

Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records EX-0012.04 against AC-3 Access Enforcement, and CSF 2.0's own crosswalk names that control as an informative reference for PR.AA-05. Through SPARTA: SPARTA's catalog maps EX-0012.04 to countermeasure CM0038 Segmentation; CM0039 Least Privilege, and that countermeasure's own CSF references include PR.AA-05. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15. PR.AA-05 is one of CSF's broader outcomes, so this edge locates the technique within CSF's structure rather than naming a specific defence.

Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records EX-0012.05 against AC-3 Access Enforcement, and CSF 2.0's own crosswalk names that control as an informative reference for PR.AA-05. Through SPARTA: SPARTA's catalog maps EX-0012.05 to countermeasure CM0038 Segmentation; CM0039 Least Privilege, and that countermeasure's own CSF references include PR.AA-05. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15. PR.AA-05 is one of CSF's broader outcomes, so this edge locates the technique within CSF's structure rather than naming a specific defence.

Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records EX-0012.06 against AC-3 Access Enforcement, and CSF 2.0's own crosswalk names that control as an informative reference for PR.AA-05. Through SPARTA: SPARTA's catalog maps EX-0012.06 to countermeasure CM0038 Segmentation; CM0039 Least Privilege, and that countermeasure's own CSF references include PR.AA-05. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15. PR.AA-05 is one of CSF's broader outcomes, so this edge locates the technique within CSF's structure rather than naming a specific defence.

Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records EX-0012.07 against AC-3 Access Enforcement, and CSF 2.0's own crosswalk names that control as an informative reference for PR.AA-05. Through SPARTA: SPARTA's catalog maps EX-0012.07 to countermeasure CM0038 Segmentation; CM0039 Least Privilege, and that countermeasure's own CSF references include PR.AA-05. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15. PR.AA-05 is one of CSF's broader outcomes, so this edge locates the technique within CSF's structure rather than naming a specific defence.

Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records EX-0012.08 against AC-3 Access Enforcement, and CSF 2.0's own crosswalk names that control as an informative reference for PR.AA-05. Through SPARTA: SPARTA's catalog maps EX-0012.08 to countermeasure CM0038 Segmentation; CM0039 Least Privilege, and that countermeasure's own CSF references include PR.AA-05. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15. PR.AA-05 is one of CSF's broader outcomes, so this edge locates the technique within CSF's structure rather than naming a specific defence.

Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records EX-0012.09 against AC-3 Access Enforcement, and CSF 2.0's own crosswalk names that control as an informative reference for PR.AA-05. Through SPARTA: SPARTA's catalog maps EX-0012.09 to countermeasure CM0038 Segmentation; CM0039 Least Privilege, and that countermeasure's own CSF references include PR.AA-05. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15. PR.AA-05 is one of CSF's broader outcomes, so this edge locates the technique within CSF's structure rather than naming a specific defence.

Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records EX-0012.10 against AC-3 Access Enforcement, and CSF 2.0's own crosswalk names that control as an informative reference for PR.AA-05. Through SPARTA: SPARTA's catalog maps EX-0012.10 to countermeasure CM0038 Segmentation; CM0039 Least Privilege, and that countermeasure's own CSF references include PR.AA-05. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15. PR.AA-05 is one of CSF's broader outcomes, so this edge locates the technique within CSF's structure rather than naming a specific defence.

Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records EX-0012.11 against AC-3 Access Enforcement, and CSF 2.0's own crosswalk names that control as an informative reference for PR.AA-05. Through SPARTA: SPARTA's catalog maps EX-0012.11 to countermeasure CM0038 Segmentation; CM0039 Least Privilege, and that countermeasure's own CSF references include PR.AA-05. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15. PR.AA-05 is one of CSF's broader outcomes, so this edge locates the technique within CSF's structure rather than naming a specific defence.

Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records EX-0012.12 against AC-3 Access Enforcement, and CSF 2.0's own crosswalk names that control as an informative reference for PR.AA-05. Through SPARTA: SPARTA's catalog maps EX-0012.12 to countermeasure CM0038 Segmentation; CM0039 Least Privilege, and that countermeasure's own CSF references include PR.AA-05. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15. PR.AA-05 is one of CSF's broader outcomes, so this edge locates the technique within CSF's structure rather than naming a specific defence.

Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records IA-0005 against AC-3 Access Enforcement, and CSF 2.0's own crosswalk names that control as an informative reference for PR.AA-05. Through SPARTA: SPARTA's catalog maps IA-0005 to countermeasure CM0038 Segmentation; CM0039 Least Privilege, and that countermeasure's own CSF references include PR.AA-05. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15. PR.AA-05 is one of CSF's broader outcomes, so this edge locates the technique within CSF's structure rather than naming a specific defence.

Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records IA-0005.02 against AC-3 Access Enforcement, and CSF 2.0's own crosswalk names that control as an informative reference for PR.AA-05. Through SPARTA: SPARTA's catalog maps IA-0005.02 to countermeasure CM0038 Segmentation; CM0039 Least Privilege; CM0065 OSAM Dual Authorization, and that countermeasure's own CSF references include PR.AA-05. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15. PR.AA-05 is one of CSF's broader outcomes, so this edge locates the technique within CSF's structure rather than naming a specific defence.

Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records IA-0011 against AC-3 Access Enforcement, and CSF 2.0's own crosswalk names that control as an informative reference for PR.AA-05. Through SPARTA: SPARTA's catalog maps IA-0011 to countermeasure CM0038 Segmentation; CM0039 Least Privilege, and that countermeasure's own CSF references include PR.AA-05. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15. PR.AA-05 is one of CSF's broader outcomes, so this edge locates the technique within CSF's structure rather than naming a specific defence.

Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records LM-0004 against AC-3 Access Enforcement, and CSF 2.0's own crosswalk names that control as an informative reference for PR.AA-05. Through SPARTA: SPARTA's catalog maps LM-0004 to countermeasure CM0038 Segmentation; CM0039 Least Privilege; CM0065 OSAM Dual Authorization, and that countermeasure's own CSF references include PR.AA-05. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15. PR.AA-05 is one of CSF's broader outcomes, so this edge locates the technique within CSF's structure rather than naming a specific defence.

Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records LM-0006 against AC-3 Access Enforcement, and CSF 2.0's own crosswalk names that control as an informative reference for PR.AA-05. Through SPARTA: SPARTA's catalog maps LM-0006 to countermeasure CM0038 Segmentation; CM0039 Least Privilege, and that countermeasure's own CSF references include PR.AA-05. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15. PR.AA-05 is one of CSF's broader outcomes, so this edge locates the technique within CSF's structure rather than naming a specific defence.