+AC-06(06) Privileged Access by Non-organizational Users
|
AC-06(06) Privileged Access by Non-organizational Users
Control
Prohibit privileged access to the system by non-organizational users.
Discussion
An organizational user is an employee or an individual considered by the organization to have the equivalent status of an employee. Organizational users include contractors, guest researchers, or individuals detailed from other organizations. A non-organizational user is a user who is not an organizational user. Policies and procedures for granting equivalent status of employees to individuals include a need-to-know, citizenship, and the relationship to the organization.
Assessment Objective
privileged access to the system by non-organizational users is prohibited.
Assessment Method
Examine
Access control policy
procedures addressing least privilege
list of system-generated privileged accounts
list of non-organizational users
system configuration settings and associated documentation
audit records
system security plan
other relevant documents or records
Interview
Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks
organizational personnel with information security responsibilities
system/network administrators
1. Přehled
1.1 Odkazy
1.2 Identifikované požadavky
1.3 Související regulace
2. Identifikované požadavky
Požadavky
| Zdroj |
Požadavek |
3. Související regulace
Propojené úkoly
|