+AC-02(03) Disable Accounts
|
AC-02(03) Disable Accounts
Control
Disable accounts within [Assignement: time period] when the accounts:- Have expired;
- Are no longer associated with a user or individual;
- Are in violation of organizational policy; or
- Have been inactive for [Assignement: time period].
Discussion
Disabling expired, inactive, or otherwise anomalous accounts supports the concepts of least privilege and least functionality which reduce the attack surface of the system.
Assessment Objective
- accounts are disabled within [Assignement: time period] when the accounts have expired;
- accounts are disabled within [Assignement: time period] when the accounts are no longer associated with a user or individual;
- accounts are disabled within [Assignement: time period] when the accounts are in violation of organizational policy;
- accounts are disabled within [Assignement: time period] when the accounts have been inactive for [Assignement: time period].
Assessment Method
Examine
Access control policy
procedures for addressing account management
system security plan
system design documentation
system configuration settings and associated documentation
system-generated list of accounts removed
system-generated list of emergency accounts disabled
system audit records
system security plan
other relevant documents or records
Interview
Organizational personnel with account management responsibilities
system/network administrators
organizational personnel with information security responsibilities
system developers
1. Übersicht
1.1 Referenzen
1.2 Identifizierte Anforderungen
1.3 Zugehörige Regulierungen
2. Identifizierte Anforderungen
Anforderungen
| Quelle |
Anforderung |
3. Zugehörige Regulierungen
Regulierungen
| Quelle |
Regulierung |
Verknüpfte Vorgänge
|