+AC-02(03) [M] Disable Accounts
|
AC-02(03) [M] Disable Accounts
Control
Disable accounts within [Assignement: time period] when the accounts:- Have expired;
- Are no longer associated with a user or individual;
- Are in violation of organizational policy; or
- Have been inactive for [Assignement: time period].
Discussion
Disabling expired, inactive, or otherwise anomalous accounts supports the concepts of least privilege and least functionality which reduce the attack surface of the system.
Assessment Objective
- accounts are disabled within [Assignement: time period] when the accounts have expired;
- accounts are disabled within [Assignement: time period] when the accounts are no longer associated with a user or individual;
- accounts are disabled within [Assignement: time period] when the accounts are in violation of organizational policy;
- accounts are disabled within [Assignement: time period] when the accounts have been inactive for [Assignement: time period].
Assessment Method
Examine
Access control policy
procedures for addressing account management
system security plan
system design documentation
system configuration settings and associated documentation
system-generated list of accounts removed
system-generated list of emergency accounts disabled
system audit records
system security plan
other relevant documents or records
Interview
Organizational personnel with account management responsibilities
system/network administrators
organizational personnel with information security responsibilities
system developers
1. Přehled
1.1 Odkazy
1.2 Identifikované požadavky
1.3 Související regulace
2. Identifikované požadavky
Požadavky
| Zdroj |
Požadavek |
3. Související regulace
Propojené úkoly
|