Assessment Objectives

In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:

• IAC-04.2_A01 prerequisites and criteria for group and role membership are defined.
  Assessment rigor: 1
  Origin: 53A_R5_AC-02_ODP[01]
• IAC-04.2_A02 criteria for account creation, enabling, modification, disabling and removal are defined.
  Assessment rigor: 1
  Origin: 53A_R5_AC-02_ODP[04] 171A_3.9.2[b]
• IAC-04.2_A03 personnel or roles required to approve requests to create accounts is/are defined.
  Assessment rigor: 1
  Origin: 53A_R5_AC-02_ODP[03]
• IAC-04.2_A04 account managers are assigned.
  Assessment rigor: 1
  Origin: 53A_R5_AC-02b.
• IAC-04.2_A05 attributes (as required) for each account are defined.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02_ODP[02]
• IAC-04.2_A06 personnel or roles to be notified is/are defined.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02_ODP[05]
• IAC-04.2_A07 time period within which to notify account managers when accounts are no longer required is defined.
  Defined parameters: within 24 hours of the account no longer being required
  Assessment rigor: 3
  Origin: 53A_R5_AC-02_ODP[06]
• IAC-04.2_A08 time period within which to notify account managers when users are terminated or transferred is defined.
  Defined parameters: within 24 hours of the termination or transfer
  Assessment rigor: 3
  Origin: 53A_R5_AC-02_ODP[07]
• IAC-04.2_A09 time period within which to notify account managers when system usage or the need to know changes for an individual is defined.
  Defined parameters: within 24 hours of the change in system usage or need to know
  Assessment rigor: 3
  Origin: 53A_R5_AC-02_ODP[08]
• IAC-04.2_A10 attributes needed to authorize system access (as required) are defined.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02_ODP[09]
• IAC-04.2_A11 the frequency of account review is defined.
  Defined parameters: quarterly for privileged access, annually for non-privileged access
  Assessment rigor: 3
  Origin: 53A_R5_AC-02_ODP[10]
• IAC-04.2_A12 account types allowed for use within the system are defined and documented.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02a.[01]
• IAC-04.2_A13 account types specifically prohibited for use within the system are defined and documented.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02a.[02]
• IAC-04.2_A14 prerequisites and criteria for group and role membership are required.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02c.
• IAC-04.2_A15 authorized users of the system are specified.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02d.01
• IAC-04.2_A16 group and role memberships are specified.
  Assessment rigor: 2
  Origin: 53A_R5_AC-02d.02 171A_R3_A.03.01.01.c.02
• IAC-04.2_A17 access authorizations (i.e., privileges) for each account are specified.
  Assessment rigor: 2
  Origin: 53A_R5_AC-02d.03[01] 171A_R3_A.03.01.01.c.03
• IAC-04.2_A18 attributes (as required) are specified for each account.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02d.03[02]
• IAC-04.2_A19 approvals are required by personnel or roles for requests to create accounts.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02e.
• IAC-04.2_A20 accounts are created in accordance with policy, procedures, prerequisites and criteria.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02f.[01]
• IAC-04.2_A21 accounts are enabled in accordance with policy, procedures, prerequisites and criteria.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02f.[02]
• IAC-04.2_A22 accounts are modified in accordance with policy, procedures, prerequisites and criteria.
  Assessment rigor: 2
  Origin: 53A_R5_AC-02f.[03] 171A_3.9.2[b]
• IAC-04.2_A23 accounts are disabled in accordance with policy, procedures, prerequisites and criteria.
  Assessment rigor: 2
  Origin: 53A_R5_AC-02f.[04] 171A_3.9.2[b]
• IAC-04.2_A24 accounts are removed in accordance with policy, procedures, prerequisites and criteria.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02f.[05]
• IAC-04.2_A25 the use of accounts is monitored.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02g.
• IAC-04.2_A26 account managers and personnel or roles are notified within an organization-defined time period when accounts are no longer required.
  Defined parameters: twenty-four (24) hours when accounts are no longer required
  Assessment rigor: 3
  Origin: 53A_R5_AC-02h.01
• IAC-04.2_A27 account managers and personnel or roles are notified within an organization-defined time period when users are terminated or transferred.
  Defined parameters: eight (8) hours when users are terminated or transferred
  Assessment rigor: 3
  Origin: 53A_R5_AC-02h.02
• IAC-04.2_A28 account managers and personnel or roles are notified within an organization-defined time period when system usage or the need to know changes for an individual.
  Defined parameters: eight (8) hours when system usage or need-to-know changes for an individual
  Assessment rigor: 3
  Origin: 53A_R5_AC-02h.03
• IAC-04.2_A29 access to the system is authorized based on a valid access authorization.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02i.01
• IAC-04.2_A30 access to the system is authorized based on intended system usage.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02i.02
• IAC-04.2_A31 access to the system is authorized based on attributes (as required).
  Assessment rigor: 3
  Origin: 53A_R5_AC-02i.03
• IAC-04.2_A32 accounts are reviewed for compliance with account management requirements frequency.
  Defined parameters: quarterly for privileged access, annually for non-privileged access
  Assessment rigor: 3
  Origin: 53A_R5_AC-02j.
• IAC-04.2_A33 a process is established for changing shared or group account authenticators (if deployed) when individuals are removed from the group.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02k.[01]
• IAC-04.2_A34 a process is implemented for changing shared or group account authenticators (if deployed) when individuals are removed from the group.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02k.[02]
• IAC-04.2_A35 account management processes are aligned with personnel termination processes.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02l.[01]
• IAC-04.2_A36 account management processes are aligned with personnel transfer processes.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02l.[02]
• IAC-04.2_A37 privileged user accounts are established and administered in accordance with organization-defined criteria.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02(07)_ODP 53A_R5_AC-02(07)(a)
• IAC-04.2_A38 privileged role or attribute assignments are monitored.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02(07)(b)
• IAC-04.2_A39 changes to roles or attributes are monitored.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02(07)(c)
• IAC-04.2_A40 access is revoked when privileged role or attribute assignments are no longer appropriate.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02(07)(d)

Incidencias vinculadas

• Secure Controls Framework -

  EN: GRCA includes the Secure Controls Framework® (SCF) content, © Secure Controls Framework Council, LLC, used under the Creative Commons Attribution-NoDerivatives 4.0 International Public License. SCF control numbers, names, descriptions and mappings appear exactly as published by the SCF Council – https://securecontrolsframework.com. GRCA may group or reorder SCF content for display, which does not change SCF content; the mappings are shown as links to the frameworks they name. Learn more at https://securecontrolsframework.com.

  DE: GRCA enthält Inhalte des Secure Controls Framework® (SCF), © Secure Controls Framework Council, LLC, genutzt unter der Creative Commons Attribution-NoDerivatives 4.0 International Public License. Nummern, Namen, Beschreibungen und Zuordnungen der SCF-Controls erscheinen genau so, wie der SCF Council sie veröffentlicht – https://securecontrolsframework.com. GRCA gruppiert oder sortiert SCF-Inhalte für die Anzeige, ohne sie zu verändern; die Zuordnungen erscheinen als Verknüpfungen zu den genannten Regelwerken. Mehr unter https://securecontrolsframework.com.