Assessment Objective

Determine if:

• AC-02(03)(a) accounts are disabled within [Assignment: time period] when the accounts have expired;
• AC-02(03)(b) accounts are disabled within [Assignment: time period] when the accounts are no longer associated with a user or individual;
• AC-02(03)(c) accounts are disabled within [Assignment: time period] when the accounts are in violation of organizational policy;
• AC-02(03)(d) accounts are disabled within [Assignment: time period] when the accounts have been inactive for [Assignment: time period].

Assessment Methods

Examine

• Access control policy
• procedures for addressing account management
• system security plan
• system design documentation
• system configuration settings and associated documentation
• system-generated list of accounts removed
• system-generated list of emergency accounts disabled
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with account management responsibilities
• system/network administrators
• organizational personnel with information security responsibilities
• system developers

Test

• Mechanisms for implementing account management functions

Gekoppelde issues

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final