+AC-06(07) [M] Review of User Privileges
|
AC-06(07) [M] Review of User Privileges
Control
- Review [Assignement: frequency] the privileges assigned to [Assignement: roles and classes] to validate the need for such privileges; and
- Reassign or remove privileges, if necessary, to correctly reflect organizational mission and business needs.
Discussion
The need for certain assigned user privileges may change over time to reflect changes in organizational mission and business functions, environments of operation, technologies, or threats. A periodic review of assigned user privileges is necessary to determine if the rationale for assigning such privileges remains valid. If the need cannot be revalidated, organizations take appropriate corrective actions.
Assessment Objective
- privileges assigned to [Assignement: roles and classes] are reviewed [Assignement: frequency] to validate the need for such privileges;
- privileges are reassigned or removed, if necessary, to correctly reflect organizational mission and business needs.
Assessment Method
Examine
Access control policy
procedures addressing least privilege
list of system-generated roles or classes of users and assigned privileges
system design documentation
system configuration settings and associated documentation
validation reviews of privileges assigned to roles or classes or users
records of privilege removals or reassignments for roles or classes of users
system audit records
system security plan
other relevant documents or records
Interview
Organizational personnel with responsibilities for reviewing least privileges necessary to accomplish specified tasks
organizational personnel with information security responsibilities
system/network administrators
1. Overview
1.1 References
1.2 Identified Requirements
1.3 Related Regulations
2. Identified Requirements
Requirements
| Source |
Requirement |
3. Related Regulations
Regulations
| Source |
Regulation |
Linked Issues
|