+AC-02 [H] Account Management
---+AC-02(01) [H] Automated System Account Management
---+AC-02(02) [H] Automated Temporary and Emergency Account Management
---+AC-02(03) [H] Disable Accounts
---+AC-02(04) [H] Automated Audit Actions
---+AC-02(05) [H] Inactivity Logout
---+AC-02(11) [H] Usage Conditions
---+AC-02(12) [H] Account Monitoring for Atypical Usage
---+AC-02(13) [H] Disable Accounts for High-risk Individuals
|
AC-02 [H] Account Management
Control
- Define and document the types of accounts allowed and specifically prohibited for use within the system;
- Assign account managers;
- Require [Assignement: prerequisites and criteria] for group and role membership;
- Specify:
- Authorized users of the system;
- Group and role membership; and
- Access authorizations (i.e., privileges) and [Assignement: attributes (as required)] for each account;
- Require approvals by [Assignement: personnel or roles] for requests to create accounts;
- Create, enable, modify, disable, and remove accounts in accordance with [Assignement: policy, procedures, prerequisites, and criteria];
- Monitor the use of accounts;
- Notify account managers and [Assignement: personnel or roles] within:
- [Assignement: time period] when accounts are no longer required;
- [Assignement: time period] when users are terminated or transferred; and
- [Assignement: time period] when system usage or need-to-know changes for an individual;
- Authorize access to the system based on:
- A valid access authorization;
- Intended system usage; and
- [Assignement: attributes (as required)];
- Review accounts for compliance with account management requirements [Assignement: frequency];
- Establish and implement a process for changing shared or group account authenticators (if deployed) when individuals are removed from the group; and
- Align account management processes with personnel termination and transfer processes.
Discussion
Examples of system account types include individual, shared, group, system, guest, anonymous, emergency, developer, temporary, and service. Identification of authorized system users and the specification of access privileges reflect the requirements in other controls in the security plan. Users requiring administrative privileges on system accounts receive additional scrutiny by organizational personnel responsible for approving such accounts and privileged access, including system owner, mission or business owner, senior agency information security officer, or senior agency official for privacy. Types of accounts that organizations may wish to prohibit due to increased risk include shared, group, emergency, anonymous, temporary, and guest accounts.
Where access involves personally identifiable information, security programs collaborate with the senior agency official for privacy to establish the specific conditions for group and role membership; specify authorized users, group and role membership, and access authorizations for each account; and create, adjust, or remove system accounts in accordance with organizational policies. Policies can include such information as account expiration dates or other factors that trigger the disabling of accounts. Organizations may choose to define access privileges or other attributes by account, type of account, or a combination of the two. Examples of other attributes required for authorizing access include restrictions on time of day, day of week, and point of origin. In defining other system account attributes, organizations consider system-related requirements and mission/business requirements. Failure to consider these factors could affect system availability.
Temporary and emergency accounts are intended for short-term use. Organizations establish temporary accounts as part of normal account activation procedures when there is a need for short-term accounts without the demand for immediacy in account activation. Organizations establish emergency accounts in response to crisis situations and with the need for rapid account activation. Therefore, emergency account activation may bypass normal account authorization processes. Emergency and temporary accounts are not to be confused with infrequently used accounts, including local logon accounts used for special tasks or when network resources are unavailable (may also be known as accounts of last resort). Such accounts remain available and are not subject to automatic disabling or removal dates. Conditions for disabling or deactivating accounts include when shared/group, emergency, or temporary accounts are no longer required and when individuals are transferred or terminated. Changing shared/group authenticators when members leave the group is intended to ensure that former group members do not retain access to the shared or group account. Some types of system accounts may require specialized training.
Assessment Objective
- account types allowed for use within the system are defined and documented;
- account types specifically prohibited for use within the system are defined and documented;
- account managers are assigned;
- [Assignement: prerequisites and criteria] for group and role membership are required;
- authorized users of the system are specified;
- group and role membership are specified;
- access authorizations (i.e., privileges) are specified for each account;
- [Assignement: attributes (as required)] are specified for each account;
- approvals are required by [Assignement: personnel or roles] for requests to create accounts;
- accounts are created in accordance with [Assignement: policy, procedures, prerequisites, and criteria];
- accounts are enabled in accordance with [Assignement: policy, procedures, prerequisites, and criteria];
- accounts are modified in accordance with [Assignement: policy, procedures, prerequisites, and criteria];
- accounts are disabled in accordance with [Assignement: policy, procedures, prerequisites, and criteria];
- accounts are removed in accordance with [Assignement: policy, procedures, prerequisites, and criteria];
- the use of accounts is monitored;
- account managers and [Assignement: personnel or roles] are notified within [Assignement: time period] when accounts are no longer required;
- account managers and [Assignement: personnel or roles] are notified within [Assignement: time period] when users are terminated or transferred;
- account managers and [Assignement: personnel or roles] are notified within [Assignement: time period] when system usage or the need to know changes for an individual;
- access to the system is authorized based on a valid access authorization;
- access to the system is authorized based on intended system usage;
- access to the system is authorized based on [Assignement: attributes (as required)];
- accounts are reviewed for compliance with account management requirements [Assignement: frequency];
- a process is established for changing shared or group account authenticators (if deployed) when individuals are removed from the group;
- a process is implemented for changing shared or group account authenticators (if deployed) when individuals are removed from the group;
- account management processes are aligned with personnel termination processes;
- account management processes are aligned with personnel transfer processes.
Assessment Method
Examine
Access control policy
personnel termination policy and procedure
personnel transfer policy and procedure
procedures for addressing account management
system design documentation
system configuration settings and associated documentation
list of active system accounts along with the name of the individual associated with each account
list of recently disabled system accounts and the name of the individual associated with each account
list of conditions for group and role membership
notifications of recent transfers, separations, or terminations of employees
access authorization records
account management compliance reviews
system monitoring records
system audit records
system security plan
privacy plan
other relevant documents or records
Interview
Organizational personnel with account management responsibilities
system/network administrators
organizational personnel with information security with information security and privacy responsibilities
1. Panoramica
| Titolo |
Standard |
|
AC-02(01) [H] Automated System Account Management
|
Control
Support the management of system accounts using [Assignement: automated mechanisms].
Discussion
Automated system account management includes using automated mechanisms to create, enable, modify, disable, and remove accounts; notify account managers when an account is created, enabled, modified, disabled, or removed, or when users are terminated or transferred; monitor system account usage; and report atypical system account usage. Automated mechanisms can include internal system functions and email, telephonic, and text messaging notifications.
Assessment Objective
the management of system accounts is supported using [Assignement: automated mechanisms].
Assessment Method
Examine
Access control policy
procedures for addressing account management
system design documentation
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records
Interview
Organizational personnel with account management responsibilities
system/network administrators
organizational personnel with information security with information security responsibilities
system developers
|
|
AC-02(02) [H] Automated Temporary and Emergency Account Management
|
Control
Automatically [Selection: remove; disable] temporary and emergency accounts after [Assignement: time period].
Discussion
Management of temporary and emergency accounts includes the removal or disabling of such accounts automatically after a predefined time period rather than at the convenience of the system administrator. Automatic removal or disabling of accounts provides a more consistent implementation.
Assessment Objective
temporary and emergency accounts are automatically [Selection: remove; disable] after [Assignement: time period].
Assessment Method
Examine
Access control policy
procedures for addressing account management
system design documentation
system configuration settings and associated documentation
system-generated list of temporary accounts removed and/or disabled
system-generated list of emergency accounts removed and/or disabled
system audit records
system security plan
other relevant documents or records
Interview
Organizational personnel with account management responsibilities
system/network administrators
organizational personnel with information security with information security responsibilities
system developers
|
|
AC-02(03) [H] Disable Accounts
|
Control
Disable accounts within [Assignement: time period] when the accounts:- Have expired;
- Are no longer associated with a user or individual;
- Are in violation of organizational policy; or
- Have been inactive for [Assignement: time period].
Discussion
Disabling expired, inactive, or otherwise anomalous accounts supports the concepts of least privilege and least functionality which reduce the attack surface of the system.
Assessment Objective
- accounts are disabled within [Assignement: time period] when the accounts have expired;
- accounts are disabled within [Assignement: time period] when the accounts are no longer associated with a user or individual;
- accounts are disabled within [Assignement: time period] when the accounts are in violation of organizational policy;
- accounts are disabled within [Assignement: time period] when the accounts have been inactive for [Assignement: time period].
Assessment Method
Examine
Access control policy
procedures for addressing account management
system security plan
system design documentation
system configuration settings and associated documentation
system-generated list of accounts removed
system-generated list of emergency accounts disabled
system audit records
system security plan
other relevant documents or records
Interview
Organizational personnel with account management responsibilities
system/network administrators
organizational personnel with information security responsibilities
system developers
|
|
AC-02(04) [H] Automated Audit Actions
|
Control
Automatically audit account creation, modification, enabling, disabling, and removal actions.
Discussion
Account management audit records are defined in accordance with [AU-02](#au-2) and reviewed, analyzed, and reported in accordance with [AU-06](#au-6).
Assessment Objective
- account creation is automatically audited;
- account modification is automatically audited;
- account enabling is automatically audited;
- account disabling is automatically audited;
- account removal actions are automatically audited.
Assessment Method
Examine
Access control policy
procedures addressing account management
system design documentation
system configuration settings and associated documentation
notifications/alerts of account creation, modification, enabling, disabling, and removal actions
system audit records
system security plan
other relevant documents or records
Interview
Organizational personnel with account management responsibilities
system/network administrators
organizational personnel with information security responsibilities
|
|
AC-02(05) [H] Inactivity Logout
|
Control
Require that users log out when [Assignement: time period of expected inactivity or description of when to log out].
Discussion
Inactivity logout is behavior- or policy-based and requires users to take physical action to log out when they are expecting inactivity longer than the defined period. Automatic enforcement of inactivity logout is addressed by [AC-11](#ac-11).
Assessment Objective
users are required to log out when [Assignement: time period of expected inactivity or description of when to log out].
Assessment Method
Examine
Access control policy
procedures addressing account management
system design documentation
system configuration settings and associated documentation
security violation reports
system audit records
system security plan
other relevant documents or records
Interview
Organizational personnel with account management responsibilities
system/network administrators
organizational personnel with information security responsibilities
users that must comply with inactivity logout policy
|
|
AC-02(11) [H] Usage Conditions
|
Control
Enforce [Assignement: circumstances and/or usage conditions] for [Assignement: system accounts].
Discussion
Specifying and enforcing usage conditions helps to enforce the principle of least privilege, increase user accountability, and enable effective account monitoring. Account monitoring includes alerts generated if the account is used in violation of organizational parameters. Organizations can describe specific conditions or circumstances under which system accounts can be used, such as by restricting usage to certain days of the week, time of day, or specific durations of time.
Assessment Objective
[Assignement: circumstances and/or usage conditions] for [Assignement: system accounts] are enforced.
Assessment Method
Examine
Access control policy
procedures addressing account management
system design documentation
system configuration settings and associated documentation
system-generated list of system accounts and associated assignments of usage circumstances and/or usage conditions
system audit records
system security plan
other relevant documents or records
Interview
Organizational personnel with account management responsibilities
system/network administrators
organizational personnel with information security responsibilities
system developers
|
|
AC-02(12) [H] Account Monitoring for Atypical Usage
|
Control
- Monitor system accounts for [Assignement: atypical usage] ; and
- Report atypical usage of system accounts to [Assignement: personnel or roles].
Discussion
Atypical usage includes accessing systems at certain times of the day or from locations that are not consistent with the normal usage patterns of individuals. Monitoring for atypical usage may reveal rogue behavior by individuals or an attack in progress. Account monitoring may inadvertently create privacy risks since data collected to identify atypical usage may reveal previously unknown information about the behavior of individuals. Organizations assess and document privacy risks from monitoring accounts for atypical usage in their privacy impact assessment and make determinations that are in alignment with their privacy program plan.
Assessment Objective
- system accounts are monitored for [Assignement: atypical usage];
- atypical usage of system accounts is reported to [Assignement: personnel or roles].
Assessment Method
Examine
Access control policy
procedures addressing account management
system design documentation
system configuration settings and associated documentation
system monitoring records
system audit records
audit tracking and monitoring reports
privacy impact assessment
system security plan
privacy plan
other relevant documents or records
Interview
Organizational personnel with account management responsibilities
system/network administrators
organizational personnel with information security responsibilities
|
|
AC-02(13) [H] Disable Accounts for High-risk Individuals
|
Control
Disable accounts of individuals within [Assignement: time period] of discovery of [Assignement: significant risks].
Discussion
Users who pose a significant security and/or privacy risk include individuals for whom reliable evidence indicates either the intention to use authorized access to systems to cause harm or through whom adversaries will cause harm. Such harm includes adverse impacts to organizational operations, organizational assets, individuals, other organizations, or the Nation. Close coordination among system administrators, legal staff, human resource managers, and authorizing officials is essential when disabling system accounts for high-risk individuals.
Assessment Objective
accounts of individuals are disabled within [Assignement: time period] of discovery of [Assignement: significant risks].
Assessment Method
Examine
Access control policy
procedures addressing account management
system design documentation
system configuration settings and associated documentation
system-generated list of disabled accounts
list of user activities posing significant organizational risk
system audit records
system security plan
other relevant documents or records
Interview
Organizational personnel with account management responsibilities
system/network administrators
organizational personnel with information security responsibilities
|
1.1 Riferimenti
1.2 Requisiti identificati
1.3 Regolamentazioni correlate
2. Requisiti identificati
Requisiti
| Fonte |
Requisito |
3. Regolamentazioni correlate
Regolamentazioni
| Fonte |
Regolamentazione |
Ticket collegati
|