Identity and Access Management Compliance Across Frameworks
GCA's identity and access management compliance matrices map identity work to the regulations, standards and guidance that healthcare, financial, energy, transportation, government and public-company teams commonly work with. Each matrix shows where identity work is typically the primary implementation of a requirement, where it supports a control another team owns, and which requirements are outside identity scope (GCA classification).
Start with the group that matches your regulator or your buyer. Each matrix carries its own notice, date and version. This page is general reference material, not legal, audit or compliance advice. It also lists the frameworks for which GCA does not publish a public mapping, and the reason for each.
Identity matrices by framework
Choose a framework to see where GCA's identity work contributes to each requirement and which technology families commonly help.
Healthcare and life sciences
Financial services
Financial services identity services
- SOX ITGC GCA-authored control set, no official catalog
- NYDFS 23 NYCRR 500
- GLBA Safeguards Rule
- FFIEC Authentication and Access
Energy and transportation
Energy and utilities identity services
- NERC CIP
- TSA pipeline cyber rule (proposed) Proposed rule (NPRM), not law
Government and public sector
Frameworks and standards
Frameworks we don't publish a public mapping for
We don't publish a public mapping for the frameworks below, because their publishers' terms restrict that use or require a separate license for it, or because they don't set out identity controls to map. That isn't a limit on engagement work. In an engagement, we work from your organization's licensed copy of the framework and follow the publisher's terms for that use.
License restrictions
- PCI DSS v4.0.1
- The PCI Security Standards Council's terms allow its materials to be used only for personal, non-commercial purposes, and they bar publishing or preparing derivative works of them without a separate written agreement, so we don't publish a mapping of PCI DSS v4.0.1.
- ISO/IEC 27001:2022
- ISO's copyright terms require written permission to reproduce or adapt its publications, so we don't publish a mapping of ISO/IEC 27001:2022.
- COBIT 2019
- ISACA requires an annual license when COBIT 2019 content is used in commercial works or in advisory or consulting services, so we don't publish a mapping of it.
- HITRUST CSF
- HITRUST licenses the HITRUST CSF for a licensee's own internal business purposes, and its license agreement prohibits derivative works without HITRUST's written consent and disclosure to anyone who isn't a licensee or authorized user, so we don't publish a mapping of it.
- SOC 2 (AICPA Trust Services Criteria)
- The AICPA holds the copyright in the Trust Services Criteria, and reproducing them requires the AICPA's permission, so we don't publish a mapping of them.
- CIS Controls v8.1
- The Center for Internet Security publishes the CIS Controls under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 license, under which commercial use needs CIS's prior approval and modified versions may not be distributed, so we don't publish a mapping of them.
- CSA Cloud Controls Matrix
- The Cloud Security Alliance allows free use of the Cloud Controls Matrix for internal purposes and requires a CCM license to customize it or use it commercially, including in consulting projects, so we don't publish a mapping of it.
No identity control catalog to map
- SEC cybersecurity disclosure rules
- The SEC's cybersecurity rules (Item 106 of Regulation S-K and Item 1.05 of Form 8-K) require disclosure of cybersecurity risk management, strategy, governance and material incidents, and they don't prescribe security controls to map.
- GDPR
- The regulation requires appropriate security measures (Article 32), and it does not enumerate identity controls to map.
- FERPA
- FERPA protects the privacy of student education records and requires reasonable methods to limit school officials' access to records in which they have a legitimate educational interest, but it doesn't set out a catalog of identity controls to map.
Frequently Asked Questions
Why doesn't GCA publish a mapping for every framework?
Some publishers restrict how their text can be used, so we don't reproduce or map content we don't have clear rights to use. Others set governance or disclosure obligations rather than identity controls. For license-restricted frameworks, we work from your organization's licensed copy in an engagement, within the publisher's terms for that use.
What does 'contributes to' mean on these pages?
It means identity work is typically the primary implementation of a requirement, or a supporting input to a control another team owns. It does not mean a requirement is met, and it does not predict an assessment result.
Are these matrices official publisher documents?
No. Each matrix is GCA's practice view with its own notice, date and version. Requirement text is quoted only where the publisher's terms allow it, and the source publication controls.
How current are the matrices?
Every matrix is reviewed on a 90-day cycle, and the last review date appears on that page. Source text changes, so confirm current requirements with the issuing authority before you rely on a page.
Which framework should we start with?
Start with the group that matches your regulator or your buyer. If you're not sure which framework applies, ask us for an engagement-specific mapping.