Support the management of system accounts using organization-defined automated mechanisms.

Automatically remove or disable temporary and emergency accounts after an organization-defined time-period for each type of account.

Enforce the organization-defined limit of consecutive invalid logon attempts by a user during the organization-defined time period.

Ensure that audit records containing information that establishes the outcome of the event.

Provide the capability to centrally review and analyze audit records from multiple components within the system.

Protect audit information from unauthorized access.

Protect audit information from unauthorized modification.

Protect audit information from unauthorized deletion.

For public key-based authentication, map the authenticated identity to the account of the individual or group.

The information system enforces password complexity by the minimum number of upper case characters used.

The information system enforces password complexity by the minimum number of lower case characters used.

The information system enforces password complexity by the minimum number of numeric characters used.

The information system, for password-based authentication, when new passwords are created, enforces that at least an organization-defined number of characters are changed.

The information system, for password-based authentication, stores only cryptographically-protected passwords.

For password-based authentication, transmit passwords only over cryptographically-protected channels.

The information system enforces minimum password lifetime restrictions.

The information system enforces maximum password lifetime restrictions.

The information system prohibits password reuse for the organization-defined number of generations.

The information system enforces minimum password length.

Obscure feedback of authentication information during the authentication process to protect the information from possible exploitation and use by unauthorized individuals.

Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.

Implement multifactor authentication for access to privileged accounts.

Implement multifactor authentication for access to non-privileged accounts.

The organization manages information system identifiers by disabling the identifier after an organization-defined time period of inactivity.

Prevent unauthorized and unintended information transfer via shared system resources.

Implement cryptographic mechanisms to protect the integrity of audit information.

Enforce approved authorizations for controlling the flow of information within the system based on organization-defined information flow control policies.

Automatically audit account modification actions.

Protect audit tools from unauthorized access.

Protect audit tools from unauthorized modification.

Protect audit tools from unauthorized deletion.

Limit privileges to change software resident within software libraries.

The information system enforces password complexity by the minimum number of special characters used.

Defines the restrictions to be followed on the use of open source software.

Prevent program execution in accordance with organization-defined policies, rules of behavior, and/or access agreements regarding software program usage and restrictions; rules authorizing the terms and conditions of software program usage.

The organization updates the information system component inventory per organization-defined frequency.

Defines the personnel or roles to be notified when unauthorized hardware, software, and firmware components are detected within the system.

When unauthorized hardware, software, and firmware components are detected within the system, the organization takes action to disable network access by such components, isolates the components, and/or notifies organization-defined personnel or roles.

The information system prohibits user installation of software without explicit privileged status.

Enforce access restrictions using organization-defined mechanisms.

The Information system supports auditing of the enforcement actions.

Defines the selectable event criteria to be used as the basis for changes to the auditing to be performed on organization-defined system components, by organization-defined individuals or roles, within organization-defined time thresholds.

Implement replay-resistant authentication mechanisms for access to privileged accounts and/or non-privileged accounts.

Assign account managers.

The information system terminates shared/group account credentials when members leave the group.

Uniquely identify and authenticate source by organization, system, application, service, and/or individual for information transfer.

The information system uniquely authenticates destination by organization, system, application, and/or individual for information transfer.

Prevent non-privileged users from executing privileged functions.

Automatically lock the account or node for either an organization-defined time period, until the locked account or node is released by an administrator, or delays the next logon prompt according to the organization-defined delay algorithm when the maximum number of unsuccessful logon attempts is exceeded.

Disable accounts when the accounts have expired.

Automatically generate audit records of the enforcement actions.

Allow user installation of software only with explicit privileged status.

Require users to be individually authenticated before granting access to the shared accounts or resources.

For password-based authentication, verify when users create or update passwords, that the passwords are not found on the list of commonly-used, expected, or compromised passwords in IA-5 (1) (a).

For password-based authentication, store passwords using an approved salted key derivation function, preferably using a keyed hash.

For password-based authentication, enforce organization-defined composition and complexity rules.

Account Management

Automated System Account Management

Removal of Temporary / Emergency Accounts

Automated Audit Actions

Shared / Group Account Credential Termination

Access Enforcement

Information Flow Enforcement

Domain Authentication

Prohibit Non-privileged Users from Executing Privileged Functions

Unsuccessful Logon Attempts

Content of Audit Records

Central Review and Analysis

Protection of Audit Information

Cryptographic Protection

Changes by Authorized Individuals

Automated Access Enforcement / Auditing

Limit Library Privileges

Prevent Program Execution

Information System Component Inventory

Automated Unauthorized Component Detection

Open Source Software

Prohibit Installation Without Privileged Status

Identification and Authentication (organizational Users)

Network Access to Privileged Accounts

Network Access to Non-privileged Accounts

Network Access to Privileged Accounts - Replay Resistant

Identifier Management

Password-based Authentication

Pki-based Authentication

Authenticator Feedback

Information in Shared Resources