Title

Administrator Passwords are changed when necessary. (Cat II impact)

Discussion

This check verifies that the passwords for the default and backup administrator accounts are changed at least annually or when any member of the administrative team leaves the organization.

Check Content

Interview the SA or IAM to determine if the site has a policy that requires the default and backup admin passwords to be changed at least annually or when any member of the administrative team leaves the organization.

Fix Text

Define a policy for required password changes for the default and backup admin account.

Additional Identifiers

Rule ID: SV-29747r1_rule

Vulnerability ID: V-14225

Group Title: Administrator Account Password Changes

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.