+AC-02(03) [M] Disable Accounts
|
AC-02(03) [M] Disable Accounts
Control
Disable accounts within [Assignement: time period] when the accounts:- Have expired;
- Are no longer associated with a user or individual;
- Are in violation of organizational policy; or
- Have been inactive for [Assignement: time period].
Discussion
Disabling expired, inactive, or otherwise anomalous accounts supports the concepts of least privilege and least functionality which reduce the attack surface of the system.
Assessment Objective
- accounts are disabled within [Assignement: time period] when the accounts have expired;
- accounts are disabled within [Assignement: time period] when the accounts are no longer associated with a user or individual;
- accounts are disabled within [Assignement: time period] when the accounts are in violation of organizational policy;
- accounts are disabled within [Assignement: time period] when the accounts have been inactive for [Assignement: time period].
Assessment Method
Examine
Access control policy
procedures for addressing account management
system security plan
system design documentation
system configuration settings and associated documentation
system-generated list of accounts removed
system-generated list of emergency accounts disabled
system audit records
system security plan
other relevant documents or records
Interview
Organizational personnel with account management responsibilities
system/network administrators
organizational personnel with information security responsibilities
system developers
1. Oversigt
1.1 Referencer
1.2 Identificerede krav
1.3 Relaterede reguleringer
2. Identificerede krav
3. Relaterede reguleringer
Reguleringer
| Kilde |
Regulering |
Linkede sager
|