Assessment Objectives

In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:

• IAC-08_A01 criteria for account creation, enabling, modification, disabling and removal are defined.
  Assessment rigor: 1
  Origin: 53A_R5_AC-02_ODP[04]
• IAC-08_A02 approvals are required by organization-defined personnel or roles for requests to create accounts.
  Assessment rigor: 1
  Origin: 53A_R5_AC-02e.
• IAC-08_A03 accounts are created in accordance with organization-defined policy, procedures, prerequisites and criteria.
  Assessment rigor: 1
  Origin: 53A_R5_AC-02f.[01]
• IAC-08_A04 accounts are enabled in accordance with organization-defined policy, procedures, prerequisites and criteria.
  Assessment rigor: 1
  Origin: 53A_R5_AC-02f.[02]
• IAC-08_A05 accounts are modified in accordance with organization-defined policy, procedures, prerequisites and criteria.
  Assessment rigor: 1
  Origin: 53A_R5_AC-02f.[03]
• IAC-08_A06 accounts are disabled in accordance with organization-defined policy, procedures, prerequisites and criteria.
  Assessment rigor: 1
  Origin: 53A_R5_AC-02f.[04]
• IAC-08_A07 accounts are removed in accordance with organization-defined policy, procedures, prerequisites and criteria.
  Assessment rigor: 1
  Origin: 53A_R5_AC-02f.[05]
• IAC-08_A08 the use of accounts is monitored.
  Assessment rigor: 1
  Origin: 53A_R5_AC-02g.
• IAC-08_A09 accounts are reviewed for compliance with account management requirements organization-defined frequency.
  Defined parameters: quarterly for privileged access, annually for non-privileged access
  Assessment rigor: 1
  Origin: 53A_R5_AC-02j.
• IAC-08_A10 account management processes are aligned with personnel termination processes.
  Assessment rigor: 1
  Origin: 53A_R5_AC-02l.[01]
• IAC-08_A11 account management processes are aligned with personnel transfer processes.
  Assessment rigor: 1
  Origin: 53A_R5_AC-02l.[02]
• IAC-08_A12 account managers and organization-defined personnel or roles are notified within an organization-defined time period when accounts are no longer required.
  Defined parameters: twenty-four (24) hours when accounts are no longer required
  Assessment rigor: 1
  Origin: 53A_R5_AC-02h.01
• IAC-08_A13 account managers and organization-defined personnel or roles are notified within an organization-defined time period when users are terminated or transferred.
  Defined parameters: eight (8) hours when users are terminated or transferred
  Assessment rigor: 1
  Origin: 53A_R5_AC-02h.02
• IAC-08_A14 account managers and organization-defined personnel or roles are notified within an organization-defined time period when system usage or the need to know changes for an individual.
  Defined parameters: eight (8) hours when system usage or need-to-know changes for an individual
  Assessment rigor: 1
  Origin: 53A_R5_AC-02h.03
• IAC-08_A15 access to the system is authorized based on a valid access authorization.
  Assessment rigor: 2
  Origin: 53A_R5_AC-02i.01
• IAC-08_A16 access to the system is authorized based on intended system usage.
  Assessment rigor: 2
  Origin: 53A_R5_AC-02i.02
• IAC-08_A17 access to the system is authorized based on organization-defined attributes (as required).
  Assessment rigor: 2
  Origin: 53A_R5_AC-02i.03
• IAC-08_A18 the use of system accounts is monitored.
  Assessment rigor: 2
  Origin: 171A_R3_A.03.01.01.e
• IAC-08_A19 system accounts are disabled when the accounts have expired.
  Assessment rigor: 2
  Origin: 171A_R3_A.03.01.01.f.01
• IAC-08_A20 system accounts are disabled when the accounts have been inactive for <A.03.01.01.ODP[01]: time period>.
  Defined parameters: at most 90 days
  Assessment rigor: NIST 800-171
  Origin: 171A_R3_A.03.01.01.f.02
• IAC-08_A21 system accounts are disabled when the accounts are no longer associated with a user or individual.
  Assessment rigor: 2
  Origin: 171A_R3_A.03.01.01.f.03
• IAC-08_A22 system accounts are disabled when the accounts violate organizational policy.
  Assessment rigor: 2
  Origin: 171A_R3_A.03.01.01.f.04
• IAC-08_A23 system accounts are disabled when significant risks associated with individuals are discovered.
  Assessment rigor: 2
  Origin: 171A_R3_A.03.01.01.f.05
• IAC-08_A24 account types specifically prohibited for use within the system are defined and documented.
  Assessment rigor: 2
  Origin: 53A_R5_AC-02a.[02]
• IAC-08_A25 the types of transactions and functions that authorized users are permitted to execute are defined.
  Assessment rigor: 1
  Origin: 171A_3.1.2[a]
• IAC-08_A26 personnel or roles required to approve requests to create accounts is/are defined.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02_ODP[03]
• IAC-08_A27 criteria for account creation, enabling, modification, disabling and removal are defined.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02_ODP[04]
• IAC-08_A28 account types allowed for use within the system are defined and documented.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02a.[01]
• IAC-08_A29 account managers are assigned.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02b.
• IAC-08_A30 system access is limited to the defined types of transactions and functions for authorized users.
  Assessment rigor: 1
  Origin: 171A_3.1.2[b]
• IAC-08_A31 prerequisites and criteria for group and role membership are defined.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02_ODP[01]
• IAC-08_A32 attributes (as required) for each account are defined.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02_ODP[02]
• IAC-08_A33 personnel or roles required to approve requests to create accounts is/are defined.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02_ODP[03]
• IAC-08_A34 personnel or roles to be notified is/are defined.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02_ODP[05]
• IAC-08_A35 time period within which to notify account managers when accounts are no longer required is defined.
  Defined parameters: within 24 hours of the account no longer being required
  Assessment rigor: 3
  Origin: 53A_R5_AC-02_ODP[06]
• IAC-08_A36 time period within which to notify account managers when users are terminated or transferred is defined.
  Defined parameters: within 24 hours of the termination or transfer
  Assessment rigor: 3
  Origin: 53A_R5_AC-02_ODP[07]
• IAC-08_A37 time period within which to notify account managers when system usage or the need to know changes for an individual is defined.
  Defined parameters: within 24 hours of the change in system usage or need to know
  Assessment rigor: 3
  Origin: 53A_R5_AC-02_ODP[08]
• IAC-08_A38 attributes needed to authorize system access (as required) are defined.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02_ODP[09]
• IAC-08_A39 the frequency of account review is defined.
  Defined parameters: quarterly for privileged access, annually for non-privileged access
  Assessment rigor: 3
  Origin: 53A_R5_AC-02_ODP[10]
• IAC-08_A40 organization-defined prerequisites and criteria for group and role membership are required.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02c.
• IAC-08_A41 authorized users of the system are specified.
  Assessment rigor: 2
  Origin: 53A_R5_AC-02d.01 171A_R3_A.03.01.01.c.01
• IAC-08_A42 group and role membership are specified.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02d.02
• IAC-08_A43 access authorizations (e.g., privileges) are specified for each account.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02d.03[01]
• IAC-08_A44 organization-defined attributes (as required) are specified for each account.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02d.03[02]
• IAC-08_A45 a process is established for changing shared or group account authenticators (if deployed) when individuals are removed from the group.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02k.[01]
• IAC-08_A46 a process is implemented for changing shared or group account authenticators (if deployed) when individuals are removed from the group.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02k.[02]
• IAC-08_A47 the time period for account inactivity before disabling is defined.
  Assessment rigor: 2
  Origin: 171A_R3_A.03.01.01.ODP[01]
• IAC-08_A48 system account types allowed are defined.
  Assessment rigor: 2
  Origin: 171A_R3_A.03.01.01.a[01]
• IAC-08_A49 system account types prohibited are defined.
  Assessment rigor: 2
  Origin: 171A_R3_A.03.01.01.a[02]
• IAC-08_A50 account managers and designated personnel or roles are notified within <A.03.01.01.ODP[02]: time period> when accounts are no longer required.
  Defined parameters: 24 hours
  Assessment rigor: NIST 800-171
  Origin: 171A_R3_A.03.01.01.g.01
• IAC-08_A51 account managers and designated personnel or roles are notified within <A.03.01.01.ODP[03]: time period> when users are terminated or transferred.
  Defined parameters: 24 hours
  Assessment rigor: NIST 800-171
  Origin: 171A_R3_A.03.01.01.g.02
• IAC-08_A52 account managers and designated personnel or roles are notified within <A.03.01.01.ODP[04]: time period> when system usage or the need-to-know changes for an individual.
  Defined parameters: 24 hours
  Assessment rigor: NIST 800-171
  Origin: 171A_R3_A.03.01.01.g.03
• IAC-08_A53 a new password is selected upon first use after account recovery.
  Assessment rigor: 2
  Origin: 171A_R3_A.03.05.07.e

Lingitud teemad

• Secure Controls Framework -

  EN: GRCA includes the Secure Controls Framework® (SCF) content, © Secure Controls Framework Council, LLC, used under the Creative Commons Attribution-NoDerivatives 4.0 International Public License. SCF control numbers, names, descriptions and mappings appear exactly as published by the SCF Council – https://securecontrolsframework.com. GRCA may group or reorder SCF content for display, which does not change SCF content; the mappings are shown as links to the frameworks they name. Learn more at https://securecontrolsframework.com.

  DE: GRCA enthält Inhalte des Secure Controls Framework® (SCF), © Secure Controls Framework Council, LLC, genutzt unter der Creative Commons Attribution-NoDerivatives 4.0 International Public License. Nummern, Namen, Beschreibungen und Zuordnungen der SCF-Controls erscheinen genau so, wie der SCF Council sie veröffentlicht – https://securecontrolsframework.com. GRCA gruppiert oder sortiert SCF-Inhalte für die Anzeige, ohne sie zu verändern; die Zuordnungen erscheinen als Verknüpfungen zu den genannten Regelwerken. Mehr unter https://securecontrolsframework.com.