Free toolkit · Appendices C, D & E
Frameworks & references
The living version of the book’s framework mapping: how the operating model lines up with the major standards and regulations, and where to go for each source. Kept here so it can stay current as the frameworks change.
The big picture
Which framework touches which pillar
A check means the framework places explicit, named expectations on that pillar. An i means implicit alignment without dedicated treatment. n/a means it is not addressed directly. NIST CSF 2.0 and ISO 27001 touch every pillar; the AI-focused frameworks cluster around governance, people, and accountability rather than technology.
| Pillar / element | NIST CSF 2.0 | NIST 800-63 | NIST 800-53 | NIST AI RMF | ISO 27001 | ISO 42001 | EU AI Act | GDPR |
|---|---|---|---|---|---|---|---|---|
| Governance pillar | • | i | • | • | • | • | • | • |
| Lifecycle pillar | • | • | • | i | • | i | i | i |
| Access pillar | • | • | • | i | • | i | i | • |
| Technology pillar | • | • | • | i | • | i | i | i |
| People & Change pillar | • | i | • | • | • | • | • | i |
| Identity System Catalog | • | i | • | • | • | • | • | i |
| Dormant accounts | • | i | • | i | • | i | n/a | i |
| AI identities | i | i | i | • | i | • | • | i |
| Agent accountability | i | n/a | i | • | n/a | • | • | • |
• explicit i implicit n/a not addressed. Mappings are illustrative, not definitive; your obligations depend on sector, jurisdiction, contracts, and counsel.
Recurring audit questions
Three answers to keep ready
The specific operational questions that surface in nearly every audit, with the bridge sentence the operating model gives for each.
What about dormant accounts?
We do not retire identities on inactivity alone. We retire them when their purpose is gone, and for any account we can tell you who owns that purpose.
Who is accountable when an AI agent does something wrong?
Every agent has a named human owner, a defined purpose, an explicit access scope, and a lifecycle. The accountable person is named before the incident, not after it.
What does least privilege actually mean in practice?
Least privilege is not a one-time entitlement cleanup. We hold it through structure, through ownership, purpose, review cadence, and visibility, so access stays aligned as the work changes.
Standards & sources
Go to the source
Every standard and regulation the book draws on, with a link to the issuing body. Identifiers and versions are current as of publication; when one changes, return to the issuing body’s current text.
Standards and frameworks
NIST SP 800-63-4, Digital Identity Guidelines
NIST, final July 2025 (first full revision of the suite since 2017).
pages.nist.gov →NIST SP 800-53, Revision 5
Security and Privacy Controls for Information Systems and Organizations. NIST, 2020 (with later patch releases).
csrc.nist.gov →NIST AI Risk Management Framework (AI RMF 1.0)
NIST, 2023. Includes the Generative AI Profile, NIST AI 600-1 (2024).
www.nist.gov →ISO/IEC 27001:2022
The information security management system (ISMS) standard. ISO, 2022.
www.iso.org →ISO/IEC 42001:2023
The artificial intelligence management system (AIMS) standard. ISO, 2023.
www.iso.org →Regulations
EU Artificial Intelligence Act
Regulation (EU) 2024/1689. In force 2024, phased application through 2027.
eur-lex.europa.eu →General Data Protection Regulation (GDPR)
Regulation (EU) 2016/679. Applicable since May 2018.
eur-lex.europa.eu →PCI DSS v4.0.1
Payment Card Industry Data Security Standard. PCI SSC, 2024 (active since v4.0 retired Dec 2024).
www.pcisecuritystandards.org →DORA, Digital Operational Resilience Act
Regulation (EU) 2022/2554 (financial services).
eur-lex.europa.eu →Sector and regional laws named in the book
Applicability depends on sector and jurisdiction, and counsel should confirm. None of this is legal advice. The ones with a stable official source link straight to it.
Others are named in the book for the reader who needs them. Their official texts are jurisdiction-specific and change, so confirm the current version with counsel:
- Sarbanes-Oxley Act, SOX (US public companies)
- Brazil LGPD
- UK GDPR
- Japan APPI
- China PIPL
- India Digital Personal Data Protection (DPDP) Act
The US state privacy landscape shifts constantly and is not one law; the IAPP US State Privacy Legislation Tracker → keeps a current view.
Beyond the book: updates since publication
These are not in the book. They are added here because they change identity work in ways the operating model already anticipates. Status is as of October 2026; several are still moving, so confirm the current position with the issuing body and with counsel.
Cloud, sovereignty, and cross-border access
Keeping data in a region is not the same as controlling it. The questions underneath are identity questions: who holds the keys, where the provider’s privileged operators sit, and which jurisdiction can compel your identity provider and directory. Provider support access is a privilege path; map it the way you map any other.
Cloud and AI Development Act (CADA)
European Commission proposal, June 2026. Not yet law; in the legislative process. Proposes four sovereignty assurance levels for public-sector cloud, from EU-based data and infrastructure at the first level to full EU ownership and control at the fourth.
digital-strategy.ec.europa.eu →Cloud Sovereignty Framework (SEAL)
European Commission, version 1.2.1, October 2025; used in Commission cloud procurement since April 2026. Scores providers from SEAL-0 to SEAL-4 across eight objectives, including exposure to foreign legal compulsion and who holds the cryptographic keys. A procurement framework, separate from CADA.
commission.europa.eu →EU Data Act: cloud switching
Regulation (EU) 2023/2854, switching provisions applicable since 12 September 2025. Customers can switch providers on up to two months’ notice; exportable assets include metadata and security settings. Switching charges are banned from 12 January 2027. For identity: roles, policies, and federation configuration have to be able to leave with you, which is Principle 2, Identity Must Outlast Its Tools.
eur-lex.europa.eu →US CLOUD Act
Clarifying Lawful Overseas Use of Data Act, 2018. US providers can be compelled to produce data in their possession, custody, or control wherever it is stored. Executive agreements are in force with the UK and Australia; an EU-US agreement is still in negotiation. Status note on FISA Section 702: the statute lapsed on 13 June 2026; collection continues under court certifications through 17 March 2027, and reauthorization is pending in Congress.
www.justice.gov →Other EU updates
Cyber Resilience Act
Regulation (EU) 2024/2847. Vulnerability and incident reporting duties apply from 11 September 2026 (24-hour early warning, 72-hour notification); full application 11 December 2027. Identity management systems and privileged access management software are named as important products, which matters when you assess IAM vendors.
eur-lex.europa.eu →DORA: critical ICT third-party providers
The European Supervisory Authorities designated the first critical ICT third-party providers on 18 November 2025 and now oversee them directly. An identity or cloud provider can be one, so provider dependency and third-party access belong in identity governance and the risk register.
www.esma.europa.eu →eIDAS 2.0 and the EU Digital Identity Wallet
Regulation (EU) 2024/1183. Each member state must offer a certified wallet by December 2026. Regulated private relying parties that require strong user authentication, and very large online platforms, must accept it from around December 2027. The wallets and verifiable credentials the book describes as the future of identity now have a date.
eur-lex.europa.eu →US sector and government frameworks
FERPA, Family Educational Rights and Privacy Act
US education, 34 CFR Part 99. Governs access to student education records, so who can see what, and on whose authority, is an identity question.
studentprivacy.ed.gov →NERC CIP
Critical Infrastructure Protection standards for the North American bulk electric system (US and Canada). Personnel, access management, and electronic access controls are explicit requirements.
www.nerc.com →FISMA
Federal Information Security Modernization Act of 2014. US federal agencies; built on NIST SP 800-53.
www.cisa.gov →GovRAMP, formerly StateRAMP
Cloud security authorization for US state, local, tribal, and education government. Built on NIST SP 800-53, like FedRAMP.
govramp.org →CMMC 2.0
Cybersecurity Maturity Model Certification, US defense industrial base (32 CFR Part 170; DFARS 252.204-7021). Phase 1 self-assessments have applied since 10 November 2025. Phase 2, mandatory third-party assessments planned for 10 November 2026, was suspended on 13 July 2026 pending a reform review; self-assessment and NIST SP 800-171 obligations still apply.
dodcio.defense.gov →International frameworks
NIS2, Second Network and Information Security Directive
Directive (EU) 2022/2555. Places energy among the highest-scrutiny essential sectors, alongside health, transport, and digital infrastructure. Each member state applies it through its own national law.
digital-strategy.ec.europa.eu →UK NIS Regulations
The Network and Information Systems Regulations 2018, diverging from EU NIS2 after Brexit. The Cyber Security and Resilience Bill, which would update them, is before Parliament and not yet law.
www.legislation.gov.uk →SOCI Act, Security of Critical Infrastructure Act 2018 (Cth)
Australia. Critical infrastructure obligations across sectors including energy, water, and transport.
www.cisc.gov.au →Canada: Critical Cyber Systems Protection Act (Bill C-8)
Bill C-8, the successor to the lapsed Bill C-26, received Royal Assent on 15 June 2026. Its telecommunications amendments are in force; the Critical Cyber Systems Protection Act itself is not yet in force, and no operators have been designated. Confirm current status before relying on it.
www.parl.ca →Industrial and operational technology
IEC 62443 series
Security for industrial automation and control systems. International Electrotechnical Commission. A standard, not a law, and the common reference for OT identity and access.
www.iec.ch →As with every entry on this page, applicability depends on sector and jurisdiction, and counsel should confirm current requirements. None of this is legal advice.