+AC-02 [L] Account Management

AC-02 [L] Account Management

Control

  1. Define and document the types of accounts allowed and specifically prohibited for use within the system;
  2. Assign account managers;
  3. Require [Assignement: prerequisites and criteria] for group and role membership;
  4. Specify:
    1. Authorized users of the system;
    2. Group and role membership; and
    3. Access authorizations (i.e., privileges) and [Assignement: attributes (as required)] for each account;
  5. Require approvals by [Assignement: personnel or roles] for requests to create accounts;
  6. Create, enable, modify, disable, and remove accounts in accordance with [Assignement: policy, procedures, prerequisites, and criteria];
  7. Monitor the use of accounts;
  8. Notify account managers and [Assignement: personnel or roles] within:
    1. [Assignement: time period] when accounts are no longer required;
    2. [Assignement: time period] when users are terminated or transferred; and
    3. [Assignement: time period] when system usage or need-to-know changes for an individual;
  9. Authorize access to the system based on:
    1. A valid access authorization;
    2. Intended system usage; and
    3. [Assignement: attributes (as required)];
  10. Review accounts for compliance with account management requirements [Assignement: frequency];
  11. Establish and implement a process for changing shared or group account authenticators (if deployed) when individuals are removed from the group; and
  12. Align account management processes with personnel termination and transfer processes.

Discussion

Examples of system account types include individual, shared, group, system, guest, anonymous, emergency, developer, temporary, and service. Identification of authorized system users and the specification of access privileges reflect the requirements in other controls in the security plan. Users requiring administrative privileges on system accounts receive additional scrutiny by organizational personnel responsible for approving such accounts and privileged access, including system owner, mission or business owner, senior agency information security officer, or senior agency official for privacy. Types of accounts that organizations may wish to prohibit due to increased risk include shared, group, emergency, anonymous, temporary, and guest accounts. Where access involves personally identifiable information, security programs collaborate with the senior agency official for privacy to establish the specific conditions for group and role membership; specify authorized users, group and role membership, and access authorizations for each account; and create, adjust, or remove system accounts in accordance with organizational policies. Policies can include such information as account expiration dates or other factors that trigger the disabling of accounts. Organizations may choose to define access privileges or other attributes by account, type of account, or a combination of the two. Examples of other attributes required for authorizing access include restrictions on time of day, day of week, and point of origin. In defining other system account attributes, organizations consider system-related requirements and mission/business requirements. Failure to consider these factors could affect system availability. Temporary and emergency accounts are intended for short-term use. Organizations establish temporary accounts as part of normal account activation procedures when there is a need for short-term accounts without the demand for immediacy in account activation. Organizations establish emergency accounts in response to crisis situations and with the need for rapid account activation. Therefore, emergency account activation may bypass normal account authorization processes. Emergency and temporary accounts are not to be confused with infrequently used accounts, including local logon accounts used for special tasks or when network resources are unavailable (may also be known as accounts of last resort). Such accounts remain available and are not subject to automatic disabling or removal dates. Conditions for disabling or deactivating accounts include when shared/group, emergency, or temporary accounts are no longer required and when individuals are transferred or terminated. Changing shared/group authenticators when members leave the group is intended to ensure that former group members do not retain access to the shared or group account. Some types of system accounts may require specialized training.

Assessment Objective

    1. account types allowed for use within the system are defined and documented;
    2. account types specifically prohibited for use within the system are defined and documented;
  2. account managers are assigned;
  3. [Assignement: prerequisites and criteria] for group and role membership are required;
    1. authorized users of the system are specified;
    2. group and role membership are specified;
      1. access authorizations (i.e., privileges) are specified for each account;
      2. [Assignement: attributes (as required)] are specified for each account;
  5. approvals are required by [Assignement: personnel or roles] for requests to create accounts;
    1. accounts are created in accordance with [Assignement: policy, procedures, prerequisites, and criteria];
    2. accounts are enabled in accordance with [Assignement: policy, procedures, prerequisites, and criteria];
    3. accounts are modified in accordance with [Assignement: policy, procedures, prerequisites, and criteria];
    4. accounts are disabled in accordance with [Assignement: policy, procedures, prerequisites, and criteria];
    5. accounts are removed in accordance with [Assignement: policy, procedures, prerequisites, and criteria];
  7. the use of accounts is monitored;
    1. account managers and [Assignement: personnel or roles] are notified within [Assignement: time period] when accounts are no longer required;
    2. account managers and [Assignement: personnel or roles] are notified within [Assignement: time period] when users are terminated or transferred;
    3. account managers and [Assignement: personnel or roles] are notified within [Assignement: time period] when system usage or the need to know changes for an individual;
    1. access to the system is authorized based on a valid access authorization;
    2. access to the system is authorized based on intended system usage;
    3. access to the system is authorized based on [Assignement: attributes (as required)];
  10. accounts are reviewed for compliance with account management requirements [Assignement: frequency];
    1. a process is established for changing shared or group account authenticators (if deployed) when individuals are removed from the group;
    2. a process is implemented for changing shared or group account authenticators (if deployed) when individuals are removed from the group;
    1. account management processes are aligned with personnel termination processes;
    2. account management processes are aligned with personnel transfer processes.

Assessment Method

Examine

Access control policy personnel termination policy and procedure personnel transfer policy and procedure procedures for addressing account management system design documentation system configuration settings and associated documentation list of active system accounts along with the name of the individual associated with each account list of recently disabled system accounts and the name of the individual associated with each account list of conditions for group and role membership notifications of recent transfers, separations, or terminations of employees access authorization records account management compliance reviews system monitoring records system audit records system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with account management responsibilities system/network administrators organizational personnel with information security with information security and privacy responsibilities

1. Oversigt

1.1 Referencer

1.2 Identificerede krav

1.3 Relaterede reguleringer

2. Identificerede krav

Krav

3. Relaterede reguleringer

Reguleringer

Linkede sager

Sagslinks
is blocked by AC-02 [L] Account Management – Assessment Procedure
is blocked by Termination of Employment
is blocked by Account Management
is blocked by Safeguarding Data Over Open Networks
is blocked by Input Data Validation