Assessment Objective
Determine if:
- AC-02(07)(a) privileged user accounts are established and administered in accordance with [Selection: a role-based access scheme; an attribute-based access scheme];
- AC-02(07)(b) privileged role or attribute assignments are monitored;
- AC-02(07)(c) changes to roles or attributes are monitored;
- AC-02(07)(d) access is revoked when privileged role or attribute assignments are no longer appropriate.
Assessment Methods
Examine
- Access control policy
- procedures addressing account management
- system design documentation
- system configuration settings and associated documentation
- system-generated list of privileged user accounts and associated roles
- records of actions taken when privileged role assignments are no longer appropriate
- system audit records
- audit tracking and monitoring reports
- system monitoring records
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with account management responsibilities
- system/network administrators
- organizational personnel with information security responsibilities
Test
- Mechanisms implementing account management functions
- mechanisms monitoring privileged role assignments
Kwistjonijiet marbuta
| Tip ta’ link | Kwistjoni |
|---|---|
| blocks | AC-02(07) Privileged User Accounts |