Support the management of system accounts using organization-defined automated mechanisms.

Disable accounts when the accounts have been inactive for the organization-defined time-period.

Enforce the organization-defined limit of consecutive invalid logon attempts by a user during the organization-defined time period.

Limit the number of concurrent sessions for each organization-defined account and/or account type to an organization-defined number.

Protect audit information from unauthorized access.

For public key-based authentication, enforce authorized access to the corresponding private key.

For public key-based authentication, map the authenticated identity to the account of the individual or group.

The information system enforces password complexity by the minimum number of upper case characters used.

The information system enforces password complexity by the minimum number of lower case characters used.

The information system enforces password complexity by the minimum number of numeric characters used.

The information system, for password-based authentication, when new passwords are created, enforces that at least an organization-defined number of characters are changed.

The information system enforces minimum password lifetime restrictions.

The information system prohibits password reuse for the organization-defined number of generations.

The information system enforces minimum password length.

Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.

Implement multifactor authentication for access to privileged accounts.

Implement multifactor authentication for access to non-privileged accounts.

The organization requires individuals to be authenticated with an individual authenticator when a group authenticator is employed.

The organization manages information system identifiers by disabling the identifier after an organization-defined time period of inactivity.

Employ strong authentication in the establishment of nonlocal maintenance and diagnostic sessions.

Protect nonlocal maintenance sessions by employing organization-defined authenticators that are replay resistant.

Protect audit tools from unauthorized access.

The information system enforces password complexity by the minimum number of special characters used.

The information system implements replay-resistant authentication mechanisms for network access to non-privileged accounts.

The information system, for PKI-based authentication, implements a local cache of revocation data to support path discovery and validation in case of inability to access revocation information via the network.

Prohibit the use of cached authenticators after an organization-defined time period.

The information system accepts FICAM-approved third-party credentials.

The information system conforms to FICAM-issued profiles.

Automatically lock the account or node for either an organization-defined time period, until the locked account or node is released by an administrator, or delays the next logon prompt according to the organization-defined delay algorithm when the maximum number of unsuccessful logon attempts is exceeded.

Disable accounts when the accounts have expired.

Disable accounts when the accounts are no longer associated to a user.

Disable accounts when the accounts are in violation of organizational policy.

Enforce organization-defined discretionary access control policies over defined subjects and objects where the policy specifies that a subject that has been granted access to information can pass the information to any other subjects or objects.

Enforce organization-defined discretionary access control policies over defined subjects and objects where the policy specifies that a subject that has been granted access to information can grant its privileges to other subjects.

Enforce organization-defined discretionary access control policies over defined subjects and objects where the policy specifies that a subject that has been granted access to information can choose the security attributes to be associated with newly created or revised objects.

Enforce organization-defined discretionary access control policies over defined subjects and objects where the policy specifies that a subject that has been granted access to information can change the rules governing access control.

Implement organization-defined mechanisms to authenticate organization-defined remote commands.

Require users to be individually authenticated before granting access to the shared accounts or resources.

Implement multi-factor authentication for local; network; and/or remote access to privileged accounts; and/or non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.

Implement multi-factor authentication for local; network; and/or remote access to privileged accounts; and/or non-privileged accounts such that the device meets organization-defined strength of mechanism requirements.

For password-based authentication, maintain a list of commonly used, expected, or compromised passwords on an organization-defined frequency.

For password-based authentication, update the list of passwords on an organization-defined frequency.

For password-based authentication, update the list of passwords when organizational passwords are suspected to have been compromised directly or indirectly.

For password-based authentication, verify when users create or update passwords, that the passwords are not found on the list of commonly-used, expected, or compromised passwords in IA-5 (1) (a).

For password-based authentication, store passwords using an approved salted key derivation function, preferably using a keyed hash.

For password-based authentication, require immediate selection of a new password upon account recovery.

For password-based authentication, allow user selection of long passwords and passphrases, including spaces and all printable characters.

For password-based authentication, employ automated tools to assist the user in selecting strong password authenticators.

For password-based authentication, enforce organization-defined composition and complexity rules.

For public key-based authentication, implement a local cache of revocation data to support path discovery and validation.

Automated System Account Management

Disable Inactive Accounts

Access Enforcement

Unsuccessful Logon Attempts

Concurrent Session Control

Protection of Audit Information

Identification and Authentication (organizational Users)

Network Access to Privileged Accounts

Network Access to Non-privileged Accounts

Group Authentication

Network Access to Non-privileged Accounts - Replay Resistant

Identifier Management

Password-based Authentication

Pki-based Authentication

Expiration of Cached Authenticators

Acceptance of Third-party Credentials

Use of Ficam-issued Profiles

Nonlocal Maintenance

Authentication / Separation of Maintenance Sessions