The organization employs automated mechanisms to support the information system account management functions.

The information system automatically disables inactive accounts after an organization-defined time period.

The information system enforces the organization-defined limit of consecutive invalid logon attempts by a user during the organization-defined time period.

The information system generates audit records for the events defined in AU-2 d. with the content defined in AU-3.

The information system enforces password complexity by the minimum number of upper case characters used.

The information system enforces password complexity by the minimum number of lower case characters used.

The information system enforces password complexity by the minimum number of numeric characters used.

The information system, for password-based authentication, when new passwords are created, enforces that at least an organization-defined number of characters are changed.

The information system, for password-based authentication, stores only cryptographically-protected passwords.

The information system enforces minimum password lifetime restrictions.

The information system enforces maximum password lifetime restrictions.

The information system prohibits password reuse for the organization-defined number of generations.

The information system enforces minimum password length.

The organization manages information system identifiers by disabling the identifier after an organization-defined time period of inactivity.

The information system terminates the network connection associated with a communications session at the end of the session or after an organization-defined time period of inactivity.

The information system enforces password complexity by the minimum number of special characters used.

The information system automatically removes or disables emergency accounts after an organization-defined time period for each type of account.

The information system notifies organization-defined personnel or roles for account creation actions.

The information system notifies organization-defined personnel or roles for account modification actions.

The information system notifies organization-defined personnel or roles for account disabling actions.

The information system notifies organization-defined personnel or roles for account removal actions.

The information system, for PKI-based authentication, implements a local cache of revocation data to support path discovery and validation in case of inability to access revocation information via the network.

The information system allows the use of a temporary password for system logons with an immediate change to a permanent password.

The information system automatically audits account enabling actions.

The information system notifies organization-defined personnel or roles for account enabling actions.

The information system enforces organization-defined circumstances and/or usage conditions for organization-defined information system accounts.

The information system automatically locks the account or node for either an organization-defined time period, until the locked account or node is released by an administrator, or delays the next logon prompt according to the organization-defined delay algorithm when the maximum number of unsuccessful logon attempts is exceeded.

The information system automatically terminates a user session after organization-defined conditions or trigger events requiring session disconnect.

Automated System Account Management

Removal Of Temporary / Emergency Accounts

Disable Inactive Accounts

Automated Audit Actions

Usage Conditions

Unsuccessful Logon Attempts

Session Termination

Audit Generation

Identifier Management

Password-Based Authentication

Pki-Based Authentication

Network Disconnect