+AC-02(03) Disable Accounts
|
AC-02(03) Disable Accounts
Control
Disable accounts within [Assignement: time period] when the accounts:- Have expired;
- Are no longer associated with a user or individual;
- Are in violation of organizational policy; or
- Have been inactive for [Assignement: time period].
Discussion
Disabling expired, inactive, or otherwise anomalous accounts supports the concepts of least privilege and least functionality which reduce the attack surface of the system.
Assessment Objective
- accounts are disabled within [Assignement: time period] when the accounts have expired;
- accounts are disabled within [Assignement: time period] when the accounts are no longer associated with a user or individual;
- accounts are disabled within [Assignement: time period] when the accounts are in violation of organizational policy;
- accounts are disabled within [Assignement: time period] when the accounts have been inactive for [Assignement: time period].
Assessment Method
Examine
Access control policy
procedures for addressing account management
system security plan
system design documentation
system configuration settings and associated documentation
system-generated list of accounts removed
system-generated list of emergency accounts disabled
system audit records
system security plan
other relevant documents or records
Interview
Organizational personnel with account management responsibilities
system/network administrators
organizational personnel with information security responsibilities
system developers
1. Apžvalga
1.1 Nuorodos
1.2 Nustatyti reikalavimai
1.3 Susiję teisės aktai
2. Nustatyti reikalavimai
Reikalavimai
| Šaltinis |
Reikalavimas |
3. Susiję teisės aktai
Teisės aktai
| Šaltinis |
Reguliavimas |
Susietos užduotys
|