How NIST CSF 2.0's PR.AA applies to shared accounts

PR.AA is the part of the NIST Cybersecurity Framework (CSF) 2.0 that covers identity management, authentication and access control. It asks that only the people, services and devices you have authorized can get into your buildings, systems and data, and splits that into six outcomes. CSF 2.0 doesn’t say how to get there, so it has no rule against shared accounts. But NIST’s own Implementation Examples suggest one credential per person, a credential being whatever proves who you are, such as a password. If you keep a shared account, be ready to explain how you know who used it and how you cut off someone who leaves.

What CSF 2.0 is

NIST, the National Institute of Standards and Technology, published CSF 2.0 as NIST CSWP 29 on February 26, 2024. It says any organization can use it, “regardless of its size, sector, or maturity.” It also says organizations may adopt it voluntarily, and governments may require it through policies and mandates.

The core of CSF 2.0 is a list of outcomes. Six Functions sit at the top: Govern, Identify, Protect, Detect, Respond and Recover. Each splits into Categories, and each Category into Subcategories. PR.AA is a Category under Protect. The framework says plainly that it “does not prescribe how outcomes should be achieved.” Guidance on methods lives in online resources that NIST links to.

The six outcomes in PR.AA

In the Category’s own words, “Access to physical and logical assets is limited to authorized users, services, and hardware.” The Category also says access is managed in line with the assessed risk of unauthorized access. In plain words, the six Subcategories say:

• PR.AA-01: The organization manages the identities and credentials of authorized users, services and hardware.
• PR.AA-02: Identities are verified and tied to credentials, in a way that fits the situation.
• PR.AA-03: Each user, service and device has its identity checked at sign-in.
• PR.AA-04: The identity information one system passes to another after sign-in is protected and checked.
• PR.AA-05: Who may do what is set in a policy, managed, enforced and reviewed. It follows least privilege and separation of duties, so one person can’t do everything alone.
• PR.AA-06: Physical access to buildings and rooms is managed and monitored in line with risk.

PR.AA-04 concerns the information that single sign-on systems pass along, and PR.AA-06 concerns physical entry. That leaves 01, 02, 03 and 05 as the ones that bear directly on shared accounts.

What NIST’s Implementation Examples suggest

NIST publishes Implementation Examples for each Subcategory. CSF 2.0 calls them “notional examples” and says they are not a complete list of actions. Nor are they a baseline of what you must do. The examples that bear on shared accounts are these:

• PR.AA-01: Take requests for new or added access from employees, contractors and others. Track, review and fulfill them, with the system or data owner’s permission when needed. Issue, manage and revoke credentials.
• PR.AA-02: “Issue a different credential for each person (i.e., no credential sharing).”
• PR.AA-03: Require multi-factor authentication (MFA), meaning a second check besides the password. Set a minimum strength for passwords.
• PR.AA-05: Review access when someone changes roles or leaves, as well as periodically, and promptly take back what’s no longer needed. Keep access to the minimum the work needs.

What a shared account has to answer for

A shared account is one login used by several people. It raises a question under each of those four Subcategories. Splitting it into personal accounts comes first where the app allows. For the ones that can’t be split, see When shared accounts can’t be split into personal ones.

Does the organization hold the credential? (PR.AA-01)

Once a password has passed from person to person in chat or on a sticky note, the company can’t say where it is. The example’s step “revoke” also turns into changing the password for everyone at once.

Can you tie each use to a person? (PR.AA-02)

When several people share one password, the app’s records show them all as the same user. The records can’t tell you who was signed in at a given time. The PR.AA-02 example of no credential sharing protects exactly that link between person and credential. If you keep the shared account, decide how you’ll confirm each person before use and record who used it and when.

How is each person checked at sign-in? (PR.AA-03)

NIST’s small-business quick-start guide (SP 1300) says to prioritize requiring MFA on all accounts that offer it, shared accounts included. If the code goes to one person’s phone, everyone else has to ask that person at each sign-in. The trade-offs of each method are in Sharing two-step verification across a team.

Can you cut off someone who leaves right away? (PR.AA-05)

A shared account has no way to revoke one person. To lock someone out, you change the password and send the new one to everyone who stays. Until you do, the person who left can still get in. Everyone who knows the password also gets the same rights, so you can’t apply least privilege person by person.

Two outcomes outside PR.AA also come into it. DE.CM-03, under Detect, is that “personnel activity and technology usage are monitored.” Its examples include watching sign-in logs for unusual access. With a shared account, the logs can’t separate one person from another. GV.SC-10 covers what happens after a supplier relationship ends. One of its examples is to check that a supplier’s access is turned off promptly once it’s no longer needed. If the supplier’s staff know a shared password, you can’t turn off only their access.

Putting shared accounts in your Organizational Profile

CSF 2.0 suggests describing your security in an Organizational Profile, a write-up of the outcomes you’ve selected and how your company meets them. A Current Profile says which outcomes you achieve today and how well. A Target Profile says which outcomes you’ve chosen to reach.

For shared accounts, list the ones you can’t split and fill in four points for each. Who knows the password (01). How you confirm who used it (02). Who gets the second-factor code (03). When you cut off people who leave (05). The same list answers two questions from SP 1300: “Are we restricting access and privileges only to those who need it?” and whether access is removed once it’s no longer needed.

CSF 2.0 also says a Current Profile can be used to explain your security to business partners and prospective customers. So the shared-account list helps when a customer’s security review asks how you handle logins. For the other rules and frameworks on accounts, see Laws, frameworks and account access.