AC-2 Account management
What the standard requires
a. Define and document the types of accounts allowed and specifically prohibited for use within the system; b. Assign account managers; c. Require [prerequisites and criteria] for group and role membership; d. Specify: 1. Authorized users of the system; 2. Group and role membership; and 3. Access authorizations (i.e., privileges) and [attributes (as required)] for each account; e. Require approvals by [personnel or roles] for requests to create accounts; f. Create, enable, modify, disable, and remove accounts in accordance with [policy, procedures, prerequisites, and criteria]; g. Monitor the use of accounts; h. Notify account managers and [personnel or roles] within: 1. [time period] when accounts are no longer required; 2. [time period] when users are terminated or transferred; and 3. [time period] when system usage or need-to-know changes for an individual; i. Authorize access to the system based on: 1. A valid access authorization; 2. Intended system usage; and 3. [attributes (as required)]; j. Review accounts for compliance with account management requirements [frequency]; k. Establish and implement a process for changing shared or group account authenticators (if deployed) when individuals are removed from the group; and l. Align account management processes with personnel termination and transfer processes.
Quoted verbatim from NIST SP 800-53 Rev 5 (OSCAL catalog), which is in the public domain.
Maps to 4 controls in 3 other frameworks
Mappings are CMDash’s own, seeded with the product and shown on both frameworks they connect. In the product they mean evidence you attach here also counts against the controls listed above.
In CMDash this control is a row with an owner, a status, uploaded evidence kept with its full history, and an export an assessor can read.