>myctrl.tools
Preferences
Under active development — Content is continuously updated and improved
Compare

AC-2 (03)—Account Management | Disable Accounts

Moderate
High

>Control Description

Disable accounts within ⚙organization-defined time period when the accounts: (a) Have expired; (b) Are no longer associated with a user or individual; (c) Are in violation of organizational policy; or (d) Have been inactive for ⚙organization-defined time period.

>FedRAMP Baseline Requirements

Parameter Values

Additional Requirements and Guidance

AC-2 (3) Requirement: The service provider defines the time period for non-user accounts (e.g., accounts associated with devices). Where user management is a function of the service, reports of activity of consumer users shall be made available. AC-2 (3) (d) Requirement: The service provider defines the time period of inactivity for device identifiers. Guidance: For DoD clouds, see DoD cloud website for specific DoD requirements that go above and beyond FedRAMP https://public.cyber.mil/dccs/.

>Discussion

Disabling expired, inactive, or otherwise anomalous accounts supports the concepts of least privilege and least functionality which reduce the attack surface of the system.

>Assessment Interview Topics

Questions assessors commonly ask

Process & Governance:

  • •What formal policies and procedures govern the implementation of AC-2(3) (Disable Accounts)?
  • •Who are the designated roles responsible for implementing, maintaining, and monitoring AC-2(3)?
  • •How frequently is the AC-2(3) policy reviewed and updated, and what triggers policy changes?
  • •What training or awareness programs ensure personnel understand their responsibilities related to AC-2(3)?

Technical Implementation:

  • •Describe the specific technical mechanisms or controls used to enforce AC-2(3) requirements.
  • •What automated tools, systems, or technologies are deployed to implement AC-2(3)?
  • •How is AC-2(3) integrated into your system architecture and overall security posture?
  • •What configuration settings, parameters, or technical specifications enforce AC-2(3) requirements?

Evidence & Documentation:

  • •What documentation demonstrates the complete implementation of AC-2(3)?
  • •What audit logs, records, reports, or monitoring data validate AC-2(3) compliance?
  • •Can you provide evidence of periodic reviews, assessments, or testing of AC-2(3) effectiveness?
  • •What artifacts would you present during a FedRAMP assessment to demonstrate AC-2(3) compliance?

Ask AI

Configure your API key to use AI features.