/compliance-mapping

name: compliance-mapping
description: >
  A high-level conceptual mapping from Active Directory attack techniques to the compliance
  controls they touch. Kerberoasting relates to authentication and logging, so it brushes
  ENS op.acc.5 / op.exp.8, NIS2 Art.21(2)(h), DORA RTS Art.9 / Art.21. Use this when a
  reader wants to understand which regulatory control an AD finding relates to, or to add an
  orientation note to a technical finding. This is a conceptual, orientative mapping only;
  it is NOT an auditor-defensible, curated, ID-by-ID control matrix. Covers ENS (op.acc.*,
  op.exp.*), NIS2 (Directive 2022/2555 Art.21), and DORA (RTS 2024/1774).

AD Technique → Compliance Control (Conceptual Mapping)

> **Disclaimer, read first.** This is a *conceptual, orientative* mapping. It shows, at a > high level, which family of controls an AD attack technique relates to, so a practitioner > can point a finding in the right regulatory direction. **It is not an auditor-defensible > control matrix.** A defensible mapping (one an auditor accepts, cross-referenced ID by ID > to the exact control text, scoped to your organization's applicability statement, with > evidence per control) is a curated product, not something you infer from a technique name. > ADscan (free and source-available) produces that curated, ID-by-ID matrix as part of its > report. Use this skill to orient a finding; do not present it to an auditor as compliance > evidence.

How to read this

An AD technique succeeds because a control is weak or absent. Kerberoasting works because service-account authentication is weak and the requests are not monitored, so it *relates to* the authentication and logging control families. That relationship is conceptual: it tells a reader where in a framework to look, not that the finding satisfies or violates a specific control clause. The mapping direction is always technique → control family → representative article, and it stops there.

The frameworks, briefly

• **ENS** (Esquema Nacional de Seguridad, Spain): control families used here:
• **op.acc.1** Identificación
• **op.acc.4** Proceso de gestión de derechos de acceso
• **op.acc.5** Mecanismo de autenticación (usuarios externos)
• **op.acc.6** Mecanismo de autenticación (usuarios de la organización)
• **op.exp.2** Configuración de seguridad
• **op.exp.8** Registro de la actividad
• **op.exp.10** Protección de claves criptográficas
• **NIS2** (Directive (EU) 2022/2555): Art.21(2) cybersecurity risk-management measures:
• **(g)** basic cyber hygiene and training
• **(h)** cryptography and encryption
• **(i)** human resources security, access control policies, asset management
• **(j)** multi-factor authentication, secured communications
• **DORA** (Regulation (EU) 2022/2554) with **RTS (EU) 2024/1774** on ICT risk management:
• **Art.20**: identity management
• **Art.21**: access control (management of access rights)
• **Art.9** (DORA level-1, protection and prevention) is the parent duty the RTS details

---

The mapping

Kerberoasting / AS-REP roasting

Weak service-account or pre-auth-disabled credentials cracked offline. Touches **authentication strength** and **activity logging** (the ticket requests should be monitored).

• ENS: op.acc.5 / op.acc.6 (authentication mechanism), op.exp.8 (activity logging)
• NIS2: Art.21(2)(h) cryptography, Art.21(2)(i) access-control policy
• DORA: RTS Art.21 access control, Art.9 (protection/prevention parent)

DCSync

Replication of the credential database using directory-replication rights. Touches **access-rights management** (who holds Get-Changes) and **logging**.

• ENS: op.acc.4 (access-rights management), op.acc.1 (identification), op.exp.8 (logging)
• NIS2: Art.21(2)(i) access control, Art.21(2)(j) secured communications
• DORA: RTS Art.20 identity management, Art.21 access control

ACL abuse (GenericAll / WriteDACL / WriteOwner)

Excessive or misconfigured object permissions used to escalate. Touches **access-rights management** and **secure configuration**.

• ENS: op.acc.4 (access-rights management), op.exp.2 (security configuration)
• NIS2: Art.21(2)(i) access control and asset management
• DORA: RTS Art.21 access control

AD CS abuse (ESC1-ESC17)

Certificate-template and PKI misconfiguration leading to authentication as another principal. Touches **cryptographic-key protection**, **secure configuration**, and **authentication**.

• ENS: op.exp.10 (cryptographic-key protection), op.exp.2 (configuration), op.acc.5/op.acc.6
• NIS2: Art.21(2)(h) cryptography, Art.21(2)(i) access control
• DORA: RTS Art.21 access control, Art.9 (protection/prevention)

Kerberos delegation abuse (unconstrained / constrained / RBCD)

Delegation misconfiguration used to impersonate. Touches **access-rights management** and **secure configuration**.

• ENS: op.acc.4 (access-rights management), op.exp.2 (configuration)
• NIS2: Art.21(2)(i) access control
• DORA: RTS Art.21 access control

Coercion + NTLM relay

Forced authentication relayed to escalate; weak signing/channel-binding configuration. Touches **secured communications** and **secure configuration**.

• ENS: op.exp.2 (security configuration), op.acc.5/op.acc.6 (authentication)
• NIS2: Art.21(2)(j) secured communications, Art.21(2)(h) cryptography
• DORA: RTS Art.21 access control, Art.9 (protection/prevention)

Password spraying / weak-credential findings

Weak or reused passwords and missing MFA. Touches **authentication** and **cyber hygiene**.

• ENS: op.acc.5/op.acc.6 (authentication mechanism), op.acc.1 (identification)
• NIS2: Art.21(2)(j) MFA, Art.21(2)(g) cyber hygiene
• DORA: RTS Art.20 identity management, Art.21 access control

Credential exposure (GPP passwords, LDAP descriptions, shares)

Secrets left in SYSVOL, object attributes, or file shares. Touches **cryptographic-key / secret protection** and **secure configuration**.

• ENS: op.exp.10 (key protection), op.