Free toolkit · Appendices C, D & E
Frameworks & references
The living version of the book’s framework mapping: how the operating model lines up with the major standards and regulations, and where to go for each source. Kept here so it can stay current as the frameworks change.
The big picture
Which framework touches which pillar
A check means the framework places explicit, named expectations on that pillar. An i means implicit alignment without dedicated treatment. n/a means it is not addressed directly. NIST CSF 2.0 and ISO 27001 touch every pillar; the AI-focused frameworks cluster around governance, people, and accountability rather than technology.
| Pillar / element | NIST CSF 2.0 | NIST 800-63 | NIST 800-53 | NIST AI RMF | ISO 27001 | ISO 42001 | EU AI Act | GDPR |
|---|---|---|---|---|---|---|---|---|
| Governance pillar | • | i | • | • | • | • | • | • |
| Lifecycle pillar | • | • | • | i | • | i | i | i |
| Access pillar | • | • | • | i | • | i | i | • |
| Technology pillar | • | • | • | i | • | i | i | i |
| People & Change pillar | • | i | • | • | • | • | • | i |
| Identity System Catalog | • | i | • | • | • | • | • | i |
| Dormant accounts | • | i | • | i | • | i | n/a | i |
| AI identities | i | i | i | • | i | • | • | i |
| Agent accountability | i | n/a | i | • | n/a | • | • | • |
• explicit i implicit n/a not addressed. Mappings are illustrative, not definitive; your obligations depend on sector, jurisdiction, contracts, and counsel.
Recurring audit questions
Three answers to keep ready
The specific operational questions that surface in nearly every audit, with the bridge sentence the operating model gives for each.
What about dormant accounts?
We do not retire identities on inactivity alone. We retire them when their purpose is gone, and for any account we can tell you who owns that purpose.
Who is accountable when an AI agent does something wrong?
Every agent has a named human owner, a defined purpose, an explicit access scope, and a lifecycle. The accountable person is named before the incident, not after it.
What does least privilege actually mean in practice?
Least privilege is not a one-time entitlement cleanup. We hold it through structure, through ownership, purpose, review cadence, and visibility, so access stays aligned as the work changes.
Standards & sources
Go to the source
Every standard and regulation the book draws on, with a link to the issuing body. Identifiers and versions are current as of November 2026; when one changes, return to the issuing body’s current text.
Standards and frameworks
NIST Cybersecurity Framework (CSF) 2.0
National Institute of Standards and Technology, 2024.
www.nist.gov →NIST SP 800-63-4, Digital Identity Guidelines
NIST, final July 2025 (the first full revision of the suite since 2017).
pages.nist.gov →NIST SP 800-53, Revision 5, Security and Privacy Controls for Information Systems and Organizations
NIST, 2020, current as of Release 5.2.0, August 2025.
csrc.nist.gov →NIST AI Risk Management Framework (AI RMF 1.0)
NIST, 2023. Includes the Generative AI Profile, NIST AI 600-1 (2024).
www.nist.gov →ISO/IEC 27001:2022
The information security management system (ISMS) standard. International Organization for Standardization, 2022.
www.iso.org →ISO/IEC 42001:2023
The artificial intelligence management system (AIMS) standard. ISO, 2023.
www.iso.org →NIST SP 800-207, Zero Trust Architecture
NIST, 2020. Zero Trust as a security model was formalized by John Kindervag at Forrester Research in 2010; this NIST publication is the standard reference for it.
csrc.nist.gov →NIST SP 800-171, Revision 3
Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations. NIST, 2024. The current NIST text; the CMMC program still assesses contractors against Revision 2.
csrc.nist.gov →OSCAL, the Open Security Controls Assessment Language
NIST. A machine-readable format for control catalogs, system security plans, and assessment results.
pages.nist.gov →W3C Verifiable Credentials Data Model 2.0
W3C Recommendation, 2025. The standard data model for digitally signed, verifiable credentials held in digital wallets.
www.w3.org →Capability Maturity Model for Software, Version 1.1
Software Engineering Institute, Carnegie Mellon University, 1993 (CMU/SEI-93-TR-024). The best-known source of the maturity-level language that Chapter 4 refers to as the original maturity models.
NIST IR 8547, Transition to Post-Quantum Cryptography Standards
NIST, final 2026. Sets the timeline for moving off quantum-vulnerable public-key algorithms: deprecated after 2030, disallowed after 2035.
nvlpubs.nist.gov →Identity protocols
OAuth 2.0 Authorization Framework
IETF, RFC 6749, 2012. The base protocol that the OAuth extensions in the AI section build on.
www.rfc-editor.org →OpenID Connect Core 1.0
OpenID Foundation, 2014. The identity layer on top of OAuth 2.0, used for modern single sign-on.
openid.net →SAML 2.0, Security Assertion Markup Language
OASIS Standard, 2005. The long-standing federation standard for enterprise single sign-on.
docs.oasis-open.org →SCIM 2.0, System for Cross-domain Identity Management
IETF, RFC 7643 (schema) and RFC 7644 (protocol), 2015. The standard for provisioning and deprovisioning accounts across systems.
www.rfc-editor.org →FIDO2
The W3C Web Authentication (WebAuthn) standard and the FIDO Alliance Client to Authenticator Protocol (CTAP). The standards behind passkeys and phishing-resistant authentication.
fidoalliance.org →SPIFFE, the Secure Production Identity Framework for Everyone
Cloud Native Computing Foundation, graduated 2022. A standard for issuing identities to workloads and services.
spiffe.io →OpenID Shared Signals Framework, with CAEP and RISC
OpenID Foundation, final specifications 2025. Standards for sharing session and risk events between systems, the basis for the continuous re-evaluation described in Chapter 22.
openid.net →Regulations and standards
EU Artificial Intelligence Act
Regulation (EU) 2024/1689. European Union, in force 2024, amended by Regulation (EU) 2026/1744, with a phased application timeline running through August 2028.
eur-lex.europa.eu →General Data Protection Regulation (GDPR)
Regulation (EU) 2016/679. European Union, applicable since May 2018.
eur-lex.europa.eu →PCI DSS v4.0.1, Payment Card Industry Data Security Standard. A contractual industry standard enforced through the card brands rather than by a government, and included here because programs answer to it the same way. PCI Security Standards Council,
2024 (the active version since v4.0 was retired December 2024).
www.pcisecuritystandards.org →DORA, Digital Operational Resilience Act
Regulation (EU) 2022/2554. European Union (financial services).
eur-lex.europa.eu →eIDAS 2.0, the European Digital Identity Framework
Regulation (EU) 2024/1183, amending Regulation (EU) No 910/2014. European Union, in force 2024. Establishes the European Digital Identity Wallet.
eur-lex.europa.eu →Sector and regional laws named in the book
Listed for the reader who needs them; applicability depends on sector and jurisdiction, and counsel should confirm.
FISMA
Federal Information Security Modernization Act of 2014. US federal agencies; built on NIST SP 800-53.
www.cisa.gov →CMMC 2.0
Cybersecurity Maturity Model Certification, US defense industrial base (32 CFR Part 170; DFARS 252.204-7021). Phase 1 self-assessments have applied since 10 November 2025. Phase 2, mandatory third-party assessments planned for 10 November 2026, was suspended on 13 July 2026 pending a reform review; self-assessment and NIST SP 800-171 obligations still apply.
dodcio.defense.gov →GovRAMP, formerly StateRAMP
Cloud security authorization for US state, local, tribal, and education government. Built on NIST SP 800-53, like FedRAMP.
govramp.org →FERPA, Family Educational Rights and Privacy Act
US education, 34 CFR Part 99. Governs access to student education records, so who can see what, and on whose authority, is an identity question.
studentprivacy.ed.gov →NERC CIP, including CIP-004, Personnel and Training
Critical Infrastructure Protection standards for the North American bulk electric system (US and Canada). Personnel, access management, and electronic access controls are explicit requirements.
www.nerc.com →Reserve Bank of India directive on storage of payment system data, 2018
Payment data in India.
www.rbi.org.in →Other data protection laws named in the customer-identity discussion
Brazil LGPD, UK GDPR, Japan APPI, China PIPL, India Digital Personal Data Protection (DPDP) Act, and the broader patchwork of US state privacy laws.
Management and leadership
Prosci, Best Practices in Change Management
Prosci’s long-running benchmarking research on organizational change, the source of the finding in Chapter 17 that active, visible sponsorship is among the strongest predictors of change success.
www.prosci.com →Rogers, Paul, and Marcia Blenko. “Who Has the D? How Clear Decision Roles Enhance Organizational Performance.”
Harvard Business Review, January 2006. The origin of Bain & Company’s RAPID decision-rights tool named in Chapter 24.
Dekker, Sidney. Drift into Failure
Ashgate, 2011. The safety-science account of how failure builds from small, locally sensible decisions, the broader idea this book applies to identity.
Weill, Peter, and Jeanne W. Ross. IT Governance
Harvard Business School Press, 2004. The source of the widely used definition of governance as decision rights and accountability.
AI, agents, and identity
The AI and agent material in Chapter 15, and the agent lifecycle in Chapters 7 and 13, rest on the sources below. This is a young area. Where the guidance is still in draft, or where no authoritative source exists yet, this list says so.
Careful Adoption of Agentic AI Services
Joint guidance of CISA and the National Security Agency in the United States, the National Cyber Security Centre in the United Kingdom, the Australian Signals Directorate’s Australian Cyber Security Centre, the Canadian Centre for Cyber Security, and New Zealand’s National Cyber Security Centre, 1 May 2026. The most authoritative source available on agent scope, least privilege, agent registries, and constraints an agent cannot override.
www.cisa.gov →Thinking carefully before adopting agentic AI
National Cyber Security Centre (United Kingdom), 15 May 2026. A companion summary of the joint guidance above, and the source of the advice to treat an agent whose actions you cannot monitor or contain as not ready to deploy.
www.ncsc.gov.uk →OWASP Top 10 for Agentic Applications
OWASP Gen AI Security Project, 2026 edition, published December 2025. Names goal hijack, tool misuse, and identity and privilege abuse among the top risks in agentic systems.
genai.owasp.org →OWASP Top 10 for Large Language Model Applications
OWASP Gen AI Security Project, 2026 edition, published August 2026. LLM01 covers prompt injection. LLM03, excessive agency, is the source for enforcing authorization outside the model, by validating every request to downstream systems, rather than relying on the model to decide whether an action is allowed.
genai.owasp.org →OWASP Non-Human Identities Top 10
OWASP Foundation, 2025 edition. The nearest thing to a recognized risk taxonomy for nonhuman identity: improper offboarding, overprivileged accounts, long-lived secrets, and human use of nonhuman accounts.
owasp.org →NIST AI 100-2 E2025, Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations
NIST, final March 2025. The NIST treatment of direct and indirect prompt injection and the security of agents, and the companion to the AI Risk Management Framework listed above.
csrc.nist.gov →OAuth 2.0 Token Exchange
IETF, RFC 8693, 2020. Defines the actor claim, which lets a token name both the person an action was taken for and the party that acted, and draws the line between delegation and impersonation.
www.rfc-editor.org →JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens
IETF, RFC 9068, 2021. The record names the application as well as the person: the client identifier is required, and the subject is the resource owner in delegated flows.
www.rfc-editor.org →Identity Assertion JWT Authorization Grant, known as cross-app access
IETF OAuth working group. Still an IETF draft as of publication. Would let an enterprise identity provider mediate application-to-application and agent access rather than leaving it to individual user consent.
datatracker.ietf.org →Agentic AI Identity and Access Management: A New Approach
Cloud Security Alliance, 2025. Agent identity across creation, attestation, runtime authorization, and logging.
cloudsecurityalliance.org →M365 Secure Configuration Baseline for Microsoft Entra ID, one of CISA’s SCuBA baselines. Maintained continuously,
and made mandatory for United States federal civilian agencies by Binding Operational Directive 25-01. Written against one vendor’s platform, and included here because it is the clearest official statement that user consent to applications should be restricted and routed through an administrator.
www.cisa.gov →Web Bot Auth
IETF working group, chartered October 2025. All documents are drafts. Work on making automated clients identifiable to the sites they visit. Named here because it is the closest standards effort to the browser-assistant problem in Chapter 15, and because it addresses the website’s side of that problem rather than the organization’s.
datatracker.ietf.org →Two things worth naming. The sources above are newer and less settled than elsewhere in this appendix. Nonhuman identity governance rests on community and industry work rather than on a standard from one of the bodies named earlier, so read them as the best available rather than as settled. There is no authoritative source at all on AI assistants operating inside a person’s own authenticated browser session, which is why Chapter 15 treats that case as open rather than as a solved control.
Beyond the book: updates since the manuscript closed
These are not in the book. They are added here because they change identity work in ways the operating model already anticipates. Status is as of November 2026; several are still moving, so confirm the current position with the issuing body and with counsel.
Cloud, sovereignty, and cross-border access
Keeping data in a region is not the same as controlling it. The questions underneath are identity questions: who holds the keys, where the provider’s privileged operators sit, and which jurisdiction can compel your identity provider and directory. Provider support access is a privilege path; map it the way you map any other.
Cloud and AI Development Act (CADA)
European Commission proposal, June 2026. Not yet law; in the legislative process. Proposes four sovereignty assurance levels for public-sector cloud, from EU-based data and infrastructure at the first level to full EU ownership and control at the fourth.
digital-strategy.ec.europa.eu →Cloud Sovereignty Framework (SEAL)
European Commission, version 1.2.1, October 2025; used in Commission cloud procurement since April 2026. Scores providers from SEAL-0 to SEAL-4 across eight objectives, including exposure to foreign legal compulsion and who holds the cryptographic keys. A procurement framework, separate from CADA.
commission.europa.eu →EU Data Act: cloud switching
Regulation (EU) 2023/2854, switching provisions applicable since 12 September 2025. Customers can switch providers on up to two months’ notice; exportable assets include metadata and security settings. Switching charges are banned from 12 January 2027. For identity: roles, policies, and federation configuration have to be able to leave with you, which is Principle 2, Identity Must Outlast Its Tools.
eur-lex.europa.eu →US CLOUD Act
Clarifying Lawful Overseas Use of Data Act, 2018. US providers can be compelled to produce data in their possession, custody, or control wherever it is stored. Executive agreements are in force with the UK and Australia; an EU-US agreement is still in negotiation. Status note on FISA Section 702: the statute lapsed on 12 June 2026; collection continues under court certifications through 17 March 2027, and reauthorization is pending in Congress.
www.justice.gov →Other EU updates
Cyber Resilience Act
Regulation (EU) 2024/2847. Vulnerability and incident reporting duties apply from 11 September 2026 (24-hour early warning, 72-hour notification); full application 11 December 2027. Identity management systems and privileged access management software are named as important products, which matters when you assess IAM vendors.
eur-lex.europa.eu →DORA: critical ICT third-party providers
The European Supervisory Authorities designated the first critical ICT third-party providers on 18 November 2025 and now oversee them directly. An identity or cloud provider can be one, so provider dependency and third-party access belong in identity governance and the risk register.
www.esma.europa.eu →US sector and government frameworks
International frameworks
NIS2, Second Network and Information Security Directive
Directive (EU) 2022/2555. Places energy among the highest-scrutiny essential sectors, alongside health, transport, and digital infrastructure. Each member state applies it through its own national law.
digital-strategy.ec.europa.eu →UK NIS Regulations
The Network and Information Systems Regulations 2018, diverging from EU NIS2 after Brexit. The Cyber Security and Resilience Bill, which would update them, is before Parliament and not yet law.
www.legislation.gov.uk →SOCI Act, Security of Critical Infrastructure Act 2018 (Cth)
Australia. Critical infrastructure obligations across sectors including energy, water, and transport.
www.cisc.gov.au →Canada: Critical Cyber Systems Protection Act (Bill C-8)
Bill C-8, the successor to the lapsed Bill C-26, received Royal Assent on 15 June 2026. Its telecommunications amendments are in force; the Critical Cyber Systems Protection Act itself is not yet in force, and no operators have been designated. Confirm current status before relying on it.
www.parl.ca →Industrial and operational technology
IEC 62443 series
Security for industrial automation and control systems. International Electrotechnical Commission. A standard, not a law, and the common reference for OT identity and access.
www.iec.ch →As with every entry on this page, applicability depends on sector and jurisdiction, and counsel should confirm current requirements. None of this is legal advice.