AC-2—Account Management

>Control Description

Define and document the types of accounts allowed and specifically prohibited for use within the system;

Assign account managers;

Require ⚙organization-defined prerequisites and criteria for group and role membership;

Specify:

Authorized users of the system;

Group and role membership; and

Access authorizations (i.e., privileges) and ⚙organization-defined attributes (as required) for each account;

Require approvals by ⚙organization-defined personnel or roles for requests to create accounts;

Create, enable, modify, disable, and remove accounts in accordance with ⚙organization-defined policy, procedures, prerequisites, and criteria;

Monitor the use of accounts;

Notify account managers and ⚙organization-defined personnel or roles within:

⚙organization-defined time period when accounts are no longer required;

⚙organization-defined time period when users are terminated or transferred; and

⚙organization-defined time period when system usage or need-to-know changes for an individual;

Authorize access to the system based on:

A valid access authorization;

Intended system usage; and

⚙organization-defined attributes (as required);

Review accounts for compliance with account management requirements ⚙organization-defined frequency;

Establish and implement a process for changing shared or group account authenticators (if deployed) when individuals are removed from the group; and

Align account management processes with personnel termination and transfer processes.

>Related Controls

Ask AI

Configure your API key to use AI features.