03.01.01 Account Management

Statement

• a. Define the types of system accounts allowed and prohibited.

• b. Create, enable, modify, disable, and remove system accounts in accordance with policy, procedures, prerequisites, and criteria.

• c. Specify:

  • 01. Authorized users of the system,

  • 02. Group and role membership, and

  • 03. Access authorizations (i.e., privileges) for each account.

• d. Authorize access to the system based on:

  • 01. A valid access authorization and

  • 02. Intended system usage.

• e. Monitor the use of system accounts.

• f. Disable system accounts when:

  • 01. The accounts have expired,

  • 02. The accounts have been inactive for {{ insert: param, A.03.01.01.ODP.01 }},

  • 03. The accounts are no longer associated with a user or individual,

  • 04. The accounts are in violation of organizational policy, or

  • 05. Significant risks associated with individuals are discovered.

• g. Notify account managers and designated personnel or roles within:

  • 01. {{ insert: param, A.03.01.01.ODP.02 }} when accounts are no longer required.

  • 02. {{ insert: param, A.03.01.01.ODP.03 }} when users are terminated or transferred.

  • 03. {{ insert: param, A.03.01.01.ODP.04 }} when system usage or the need-to-know changes for an individual.

• h. Require that users log out of the system after {{ insert: param, A.03.01.01.ODP.05 }} of expected inactivity or when {{ insert: param, A.03.01.01.ODP.06 }}.

Guidance

This requirement focuses on account management for systems and applications. The definition and enforcement of access authorizations other than those determined by account type (e.g., privileged access, non-privileged access) are addressed in [](#/cprt/framework/version/SP_800_171_3_0_0/home?element=03.01.02)03.01.02. System account types include individual, group, temporary, system, guest, anonymous, emergency, developer, and service. Users who require administrative privileges on system accounts receive additional scrutiny by personnel responsible for approving such accounts and privileged access. Types of accounts that organizations may prohibit due to increased risk include group, emergency, guest, anonymous, and temporary. Organizations may choose to define access privileges or other attributes by account, type of account, or a combination of both. Other attributes required for authorizing access include restrictions on the time of day, day of the week, and point of origin. When defining other system account attributes, organizations consider system requirements (e.g., system upgrades, scheduled maintenance) and mission and business requirements (e.g., time zone differences, remote access to facilitate travel requirements). Users who pose a significant security risk include individuals for whom reliable evidence indicates either the intention to use authorized access to the system to cause harm or that adversaries will cause harm through them. Close coordination among mission and business owners, system administrators, human resource managers, and legal staff is essential when disabling system accounts for high-risk individuals. Time periods for the notification of organizational personnel or roles may vary. Inactivity logout is behavior- or policy-based and requires users to take physical action to log out when they are expecting inactivity longer than the defined period. Automatic enforcement of inactivity logout is addressed by [](#/cprt/framework/version/SP_800_171_3_0_0/home?element=03.01.10) 03.01.10.

Assessment objective

system accounts are created in accordance with organizational policy, procedures, prerequisites, and criteria.

Assessment objective

system accounts are enabled in accordance with organizational policy, procedures, prerequisites, and criteria.

Assessment objective

system accounts are modified in accordance with organizational policy, procedures, prerequisites, and criteria.

Assessment objective

system accounts are disabled in accordance with organizational policy, procedures, prerequisites, and criteria.

Assessment objective

system accounts are removed in accordance with organizational policy, procedures, prerequisites, and criteria.

Assessment objective

system account types allowed are defined.

Assessment objective

system account types prohibited are defined.

Assessment objective

authorized users of the system are specified.

Assessment objective

group and role memberships are specified.

Assessment objective

access authorizations (i.e., privileges) for each account are specified.

Assessment objective

access to the system is authorized based on a valid access authorization.

Assessment objective

access to the system is authorized based on intended system usage.

Assessment objective

the use of system accounts is monitored.

Assessment objective

system accounts are disabled when the accounts have expired.

Assessment objective

system accounts are disabled when the accounts have been inactive for {{ insert: param, A.03.01.01.ODP.01 }}.

Assessment objective

system accounts are disabled when the accounts are no longer associated with a user or individual.

Assessment objective

system accounts are disabled when the accounts violate organizational policy.

Assessment objective

account managers and designated personnel or roles are notified within {{ insert: param, A.03.01.01.ODP.02 }} when accounts are no longer required.

Assessment objective

account managers and designated personnel or roles are notified within {{ insert: param, A.03.01.01.ODP.03 }} when users are terminated or transferred.

Assessment objective

account managers and designated personnel or roles are notified within {{ insert: param, A.03.01.01.ODP.04 }} when system usage or the need-to-know changes for an individual.

Assessment objective

system accounts are disabled when significant risks associated with individuals are discovered.

Assessment objective

users are required to log out of the system after {{ insert: param, A.03.01.01.ODP.05 }} of expected inactivity or when the following circumstances occur: {{ insert: param, A.03.01.01.ODP.06 }}.

Assessment method

• access control policy and procedures personnel termination or transfer policies and procedures procedures for account management list of active system accounts and the name of the individual associated with each account system design documentation list of conditions for group and role membership system configuration settings notifications of recent transfers, separations, or terminations of employees list of recently disabled system accounts and the name of the individual associated with each account list of user activities that pose significant organizational risks access authorization records account management compliance reviews system monitoring and audit records system security plan system-generated list of accounts removed system-generated list of emergency accounts disabled system-generated list of disabled accounts other relevant documents and records

Assessment method

• personnel with account management responsibilities system administrators personnel with information security responsibilities system developers

Assessment method

• processes for account management on the system mechanisms for implementing account management

1. Panoramica

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

3. Regolamentazioni correlate

Ticket collegati

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final