Title

Administrator passwords must be changed as required. (Cat II impact)

Discussion

The longer a password is in use, the greater the opportunity for someone to gain unauthorized knowledge of the passwords. Passwords for the built-in administrator account and any emergency administrator accounts must be changed at least annually or when any member of the administrative team leaves the organization.

Check Content

Determine if the site has a policy that requires passwords for the built-in administrator account and any emergency administrator accounts to be changed at least annually or when any member of the administrative team leaves the organization. If a policy does not exist or is not enforced, this is a finding.

Fix Text

Define and enforce a policy that requires passwords for the built-in administrator account and any emergency administrator accounts to be changed at least annually or when any member of the administrative team leaves the organization.

Additional Identifiers

Rule ID:

Vulnerability ID: V-14225

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.