Assessment Objective
Determine if:
- system accounts are created in accordance with organizational policy, procedures, prerequisites, and criteria.
- system accounts are enabled in accordance with organizational policy, procedures, prerequisites, and criteria.
- system accounts are modified in accordance with organizational policy, procedures, prerequisites, and criteria.
- system accounts are disabled in accordance with organizational policy, procedures, prerequisites, and criteria.
- system accounts are removed in accordance with organizational policy, procedures, prerequisites, and criteria.
- system account types allowed are defined.
- system account types prohibited are defined.
- authorized users of the system are specified.
- group and role memberships are specified.
- access authorizations (i.e., privileges) for each account are specified.
- access to the system is authorized based on a valid access authorization.
- access to the system is authorized based on intended system usage.
- the use of system accounts is monitored.
- system accounts are disabled when the accounts have expired.
- system accounts are disabled when the accounts have been inactive for [Assignment: time period].
- system accounts are disabled when the accounts are no longer associated with a user or individual.
- system accounts are disabled when the accounts violate organizational policy.
- account managers and designated personnel or roles are notified within [Assignment: time period] when accounts are no longer required.
- account managers and designated personnel or roles are notified within [Assignment: time period] when users are terminated or transferred.
- account managers and designated personnel or roles are notified within [Assignment: time period] when system usage or the need-to-know changes for an individual.
- system accounts are disabled when significant risks associated with individuals are discovered.
- users are required to log out of the system after [Assignment: time period] of expected inactivity or when the following circumstances occur: [Assignment: circumstances].
Assessment Methods
Examine
- access control policy and procedures
- personnel termination or transfer policies and procedures
- procedures for account management
- list of active system accounts and the name of the individual associated with each account
- system design documentation
- list of conditions for group and role membership
- system configuration settings
- notifications of recent transfers, separations, or terminations of employees
- list of recently disabled system accounts and the name of the individual associated with each account
- list of user activities that pose significant organizational risks
- access authorization records
- account management compliance reviews
- system monitoring and audit records
- system security plan
- system-generated list of accounts removed
- system-generated list of emergency accounts disabled
- system-generated list of disabled accounts
- other relevant documents and records
Interview
- personnel with account management responsibilities
- system administrators
- personnel with information security responsibilities
- system developers
Test
- processes for account management on the system
- mechanisms for implementing account management
Tickets liés
| Type de lien | Ticket |
|---|---|
| blocks | 03.01.01 Account Management |