authentik for NIST CSF 2.0 identity and access (PR.AA)

No. authentik can enforce who gets into an application once access is granted, but the request, the owner approval and the record of that decision usually live in a ticketing system, an identity governance product or a documented process. NIST's PR.AA-01 implementation examples call for tracking and fulfilling access requests with owner approval, so decide where that record lives before go-live. In authentik, the practical step is to map each application or group to a named owner and to make group membership changes traceable to an approved request. Confirm whether your edition includes the audit logging you need for that trail, because enhanced audit logging is listed as Enterprise-only on the pricing page and must be confirmed for your subscription.

authentik provides the data that reviews need, but it does not run the certification campaign itself. A reviewer still has to confirm that each account and entitlement remains necessary, and separation of duties for critical functions is a policy decision that the tool cannot make for you. PR.AA-05 expects privileges to be reviewed periodically and on role change or departure, and expects separation of duties for critical functions to be reviewed. Plan the review cadence, the reviewers, the evidence format and the conflicting role pairs in writing. If you need automated certification workflows, confirm with the vendor and your own environment whether a governance product such as midPoint fits, since that is a separate build.

Not by itself. authentik manages accounts that exist in its directory and can be connected to upstream sources, but the trigger for a new hire or a departure has to come from your HR system, a provisioning integration or a manual ticket. The risk sits in the gap: an account that stays active after a departure keeps its access to every connected application. Define the authoritative source for employment status, the timing for disabling access, and who checks that disabled accounts have no remaining sessions or application grants. Source and SCIM options are covered on separate pages, and the exact provisioning features available to you depend on your edition, which should be confirmed.

The organization does, and authentik does not. PR.AA-01 includes giving each device a unique identifier and physically labeling authorized hardware, which belong to asset management and facilities processes. authentik can authenticate devices and service accounts where a protocol supports it, but it does not track physical equipment, print labels or maintain a hardware register. Keep your asset inventory in your CMDB or asset tool and link device identifiers to the accounts or certificates that use them. Confirm with your own asset owner which devices are in scope before you write the mapping.

Emergency access is a design decision that you need to make in advance and test. PR.AA-03 calls for ensuring emergency access to accounts essential for safety, and a single identity provider is a dependency that can take every application down with it. Typical measures include a small set of break-glass accounts held outside normal SSO, stored under dual control, monitored for any use, and tested on a schedule. Because authentik keeps its configuration and data in PostgreSQL, the database recovery plan also determines how quickly sign-in returns. Document who can invoke break-glass access, how use is reviewed afterward, and which applications must keep a local path.

No. The CSF 2.0 Core is a set of outcomes, and the Tiers and Organizational Profiles are how your organization describes its own practice and target state. NIST describes four Tiers (Partial, Risk Informed, Repeatable and Adaptive) and Current and Target profiles, and it does not certify products or implementations or offer a conformity assessment program. The identity work for PR.AA therefore belongs in a profile: record the current state of identity management, set a target tier for each Subcategory, and list the gaps and owners. authentik supports evidence for that profile, but the Tier decision is an organizational judgment. Teams working toward a formal assessment should confirm the expectations of the assessor or customer requesting it.

The Open Source edition does not include several features that matter for PR.AA controls. According to the authentik pricing page, the Enterprise-only features include Google Workspace and Microsoft Entra ID integrations, mTLS client certificate authentication, privileged access management, password history, enhanced audit logging and ticket-based support for subscriptions over $1k. The page also lists Enterprise Plus extras such as dedicated support with SLAs, multi-instance deployment support and FIPS compliance for FedRAMP requirements, with Enterprise Plus starting at $20k annually. Confirm the current feature list and pricing directly with authentik before you rely on any of these for a control, because pricing pages change.

Ask for a quote that separates the work from the software terms. The software cost depends on the authentik edition you select and the licensing model that applies to your user population, and the pricing page lists per-user Enterprise pricing with a separate charge for external users. Services costs depend on the written scope: reviewing your current roles, designing the access request and review process, configuring applications, and producing evidence. Recurring costs include authentik upgrades, backup testing and periodic reviews, which continue after go-live. Ask whether the quote covers the governance process design or only the technical configuration, because that boundary determines what your team still has to build.

No. NIST states that it does not offer certifications or endorsements of CSF-related products, implementations or services, and it has no plans to develop a conformity assessment program. Using authentik to address PR.AA is an internal design and evidence exercise. Your organization decides how well its identity controls map to the Subcategories, and any formal assurance has to come from an assessor or certification body that you engage separately. CSF 2.0 is also voluntary for most organizations, although some customers, suppliers or federal programs may require it. Confirm with those parties which evidence they expect before you scope the work.

An assessment outcome comes from whoever your customers, regulators or contracts designate, not from NIST, authentik or DeployOpen. DeployOpen prepares systems, configuration, access policies and evidence for PR.AA, but it does not issue audit reports, attestations or certifications. Independent auditors and certification bodies perform those assessments. Before the work starts, ask the party that will judge your posture which CSF Tier and Organizational Profile they expect, which Implementation Examples they want traced, and which evidence format they accept.

Effort depends mostly on the number of identity sources, applications and privileged roles that must be brought under authentik, and on how much policy work already exists. The main components are discovery, provider and application configuration, MFA and password policy design, role and group modeling, testing, and evidence collection. Some work is one-time, such as the initial integration and policy design, while other work recurs, such as access reviews, version upgrades and policy changes. Ask any partner for a written scope that lists these components separately so you can compare effort against an internal estimate.

Cost follows the scope agreed in writing. The main drivers are the number of applications to integrate, whether you need directory or HR sources, how many environments must be built (test, staging and production), the depth of access policy design, and the volume of evidence you need. Licensing is a separate line item. The authentik pricing page lists an Open Source edition at no cost, an Enterprise edition at $5 per user per month billed annually plus $0.02 per external user per month, and Enterprise Plus starting at $20k annually. Some features relevant to PR.AA, such as privileged access management and enhanced audit logging, appear on the Enterprise tiers, so check which features your design needs before you choose an edition. DeployOpen does not publish prices, and a quote follows from the written scope.

Often yes, if your team already runs identity infrastructure and can maintain the platform after handover. The authentik architecture is a server, a worker and PostgreSQL, and the Docker Compose guide positions Compose for test setups and small-scale production, while the Kubernetes guide recommends a separately managed PostgreSQL for production. Internal teams usually need time for the design work that PR.AA requires: tracing access requests to owners, defining least-privilege roles, setting review cycles and documenting separation of duties. A partner is most useful when those policy decisions are unclear, when deadlines are fixed, or when the evidence must be assembled in a format an assessor will accept.

The work needs decisions and inputs from your side. Expect to provide an inventory of identity sources such as existing directories, HR systems and any upstream identity providers. You also need an application inventory with owners, the list of systems in scope, and named policy owners who can approve roles, MFA rules, password requirements and access reviews. For PR.AA-01 you should also identify how access requests are tracked and approved today. Access to a staging environment, change windows and a contact who can approve configuration changes are usually needed as well. Confirm these items in the written scope so that delays do not come from missing inputs.

No duration is fixed across projects, so treat any timeline as a function of scope. The largest factors are the number of applications and identity sources, whether policies must be agreed across several business units, how many environments must be built and tested, and whether legacy applications need a proxy or a different protocol. External dependencies, such as application owners who must change their own configuration or a production change calendar, often matter as much as technical work. Ask for a timeline in the written scope that is tied to named milestones and inputs, and confirm the change control steps your organization requires.

authentik keeps configuration and event data in PostgreSQL, which makes it a source for evidence about who signed in, which factors were used and how access was granted. The Enterprise edition lists enhanced audit logging on its pricing page, so confirm which audit events your edition records and how long they are retained in your deployment. Common evidence includes exported policy and group configuration, MFA enrollment records, failed login reports, access review sign-offs and change records for role updates. Confirm with your assessor which artifacts they sample, and plan log forwarding and retention before the review period begins.