The organization employs automated mechanisms to support the information system account management functions.

The information system automatically removes or disables temporary accounts after an organization-defined time period for each type of account.

The information system automatically disables inactive accounts after an organization-defined time period.

The information system enforces the organization-defined limit of consecutive invalid logon attempts by a user during the organization-defined time period.

The information system generates audit records for the events defined in AU-2 d. with the content defined in AU-3.

The information system, for PKI-based authentication, maps the authenticated identity to the account of the individual or group.

The information system enforces password complexity by the minimum number of upper case characters used.

The information system enforces password complexity by the minimum number of lower case characters used.

The information system enforces password complexity by the minimum number of numeric characters used.

The information system, for password-based authentication, when new passwords are created, enforces that at least an organization-defined number of characters are changed.

The information system enforces minimum password lifetime restrictions.

The information system enforces maximum password lifetime restrictions.

The information system prohibits password reuse for the organization-defined number of generations.

The information system enforces minimum password length.

The organization implements the security configuration settings.

The information system implements multifactor authentication for network access to privileged accounts.

The information system implements multifactor authentication for network access to non-privileged accounts.

The information system implements multifactor authentication for local access to privileged accounts.

The information system implements multifactor authentication for local access to non-privileged accounts.

The organization requires individuals to be authenticated with an individual authenticator when a group authenticator is employed.

The organization manages information system identifiers by disabling the identifier after an organization-defined time period of inactivity.

The information system enforces password complexity by the minimum number of special characters used.

The information system notifies organization-defined personnel or roles for account creation actions.

The information system notifies organization-defined personnel or roles for account modification actions.

The information system notifies organization-defined personnel or roles for account disabling actions.

The information system notifies organization-defined personnel or roles for account removal actions.

The Information system supports auditing of the enforcement actions.

The information system implements replay-resistant authentication mechanisms for network access to non-privileged accounts.

The information system accepts Personal Identity Verification (PIV) credentials.

The information system accepts Personal Identity Verification (PIV) credentials from other federal agencies.

The information system allows the use of a temporary password for system logons with an immediate change to a permanent password.

The information system automatically audits account enabling actions.

The information system notifies organization-defined personnel or roles for account enabling actions.

The information system terminates shared/group account credentials when members leave the group.

The information system enforces organization-defined circumstances and/or usage conditions for organization-defined information system accounts.

The information system automatically locks the account or node for either an organization-defined time period, until the locked account or node is released by an administrator, or delays the next logon prompt according to the organization-defined delay algorithm when the maximum number of unsuccessful logon attempts is exceeded.

The information system performs verification of the correct operation of organization-defined security functions: when the system is in an organization-defined transitional state; upon command by a user with appropriate privileges; and/or on an organization-defined frequency.

Automated System Account Management

Removal Of Temporary / Emergency Accounts

Disable Inactive Accounts

Automated Audit Actions

Shared / Group Account Credential Termination

Usage Conditions

Unsuccessful Logon Attempts

Audit Generation

Automated Access Enforcement / Auditing

Configuration Settings

Network Access To Privileged Accounts

Network Access To Non-Privileged Accounts

Local Access To Privileged Accounts

Local Access To Non-Privileged Accounts

Group Authentication

Network Access To Non-Privileged Accounts - Replay Resistant

Acceptance Of Piv Credentials

Identifier Management

Password-Based Authentication

Pki-Based Authentication

Acceptance Of Piv Credentials From Other Agencies

Security Function Verification