The organization employs automated mechanisms to support the information system account management functions.

The information system automatically removes or disables temporary accounts after an organization-defined time period for each type of account.

The information system enforces the organization-defined limit of consecutive invalid logon attempts by a user during the organization-defined time period.

The information system generates audit records containing information that establishes the outcome of the event.

The information system provides the capability to centrally review and analyze audit records from multiple components within the system.

The information system protects audit information from unauthorized access.

The information system protects audit information from unauthorized modification.

The information system protects audit information from unauthorized deletion.

The information system, for PKI-based authentication, maps the authenticated identity to the account of the individual or group.

The information system enforces password complexity by the minimum number of upper case characters used.

The information system enforces password complexity by the minimum number of lower case characters used.

The information system enforces password complexity by the minimum number of numeric characters used.

The information system, for password-based authentication, when new passwords are created, enforces that at least an organization-defined number of characters are changed.

The information system, for password-based authentication, stores only cryptographically-protected passwords.

The information system, for password-based authentication, transmits only cryptographically-protected passwords.

The information system enforces minimum password lifetime restrictions.

The information system enforces maximum password lifetime restrictions.

The information system prohibits password reuse for the organization-defined number of generations.

The information system enforces minimum password length.

The information system obscures feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals.

The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

The information system uniquely identifies and authenticates organizational users (or processes acting on behalf of organizational users).

The information system implements multifactor authentication for network access to privileged accounts.

The information system implements multifactor authentication for network access to non-privileged accounts.

The organization manages information system identifiers by disabling the identifier after an organization-defined time period of inactivity.

The information system prevents unauthorized and unintended information transfer via shared system resources.

The information system implements cryptographic mechanisms to protect the integrity of audit information.

The information system enforces approved authorizations for controlling the flow of information within the system based on organization-defined information flow control policies.

The information system automatically audits account modification actions.

The information system protects audit tools from unauthorized access.

The information system protects audit tools from unauthorized modification.

The information system protects audit tools from unauthorized deletion.

The organization limits privileges to change software resident within software libraries.

The information system enforces password complexity by the minimum number of special characters used.

The organization defines the restrictions to be followed on the use of open source software.

The information system prevents program execution in accordance with organization-defined policies regarding software program usage and restrictions, and/or rules authorizing the terms and conditions of software program usage.

The organization updates the information system component inventory per organization-defined frequency.

The organization defines the personnel or roles to be notified when unauthorized hardware, software, and firmware components are detected within the information system.

When unauthorized hardware, software, and firmware components are detected within the information system, the organization takes action to disable network access by such components, isolates the components, and/or notifies organization-defined personnel or roles.

The information system prohibits user installation of software without explicit privileged status.

The information system enforces access restrictions.

The Information system supports auditing of the enforcement actions.

The organization defines the selectable event criteria to be used as the basis for changes to the auditing to be performed on organization-defined information system components, by organization-defined individuals or roles, within organization-defined time thresholds.

The information system implements replay-resistant authentication mechanisms for network access to privileged accounts.

The organization assigns account managers for information system accounts.

The information system terminates shared/group account credentials when members leave the group.

The information system uniquely identifies and authenticates source by organization, system, application, and/or individual for information transfer.

The information system uniquely authenticates destination by organization, system, application, and/or individual for information transfer.

The information system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.

The information system automatically locks the account or node for either an organization-defined time period, until the locked account or node is released by an administrator, or delays the next logon prompt according to the organization-defined delay algorithm when the maximum number of unsuccessful logon attempts is exceeded.

Account Management

Automated System Account Management

Removal Of Temporary / Emergency Accounts

Automated Audit Actions

Shared / Group Account Credential Termination

Access Enforcement

Information Flow Enforcement

Domain Authentication

Prohibit Non-Privileged Users From Executing Privileged Functions

Unsuccessful Logon Attempts

Content Of Audit Records

Central Review And Analysis

Protection Of Audit Information

Cryptographic Protection

Changes By Authorized Individuals

Automated Access Enforcement / Auditing

Limit Library Privileges

Prevent Program Execution

Information System Component Inventory

Automated Unauthorized Component Detection

Open Source Software

Prohibit Installation Without Privileged Status

Identification And Authentication (Organizational Users)

Network Access To Privileged Accounts

Network Access To Non-Privileged Accounts

Network Access To Privileged Accounts - Replay Resistant

Identifier Management

Password-Based Authentication

Pki-Based Authentication

Authenticator Feedback

Information In Shared Resources