Navigate

CCI-000011

CCI-000011 Definition

Create, enable, modify, disable, and remove system accounts in accordance with organization-defined procedures.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

The organization being inspected/assessed implements account maintenance processes to create, enable, modify, disable, and remove information system accounts in accordance with procedures or conditions defined in AC-2, 2121. The organization being inspected/assessed maintains an audit trail of account maintenance activities.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the audit trail of account maintenance activities to ensure the organization being inspected/assessed implements account maintenance processes to create, enable, modify, disable, remove, and track information system accounts in accordance with procedures or conditions defined in AC-2, 2121.

Compelling Evidence

1.) Signed and dated access control policy and/or account maintenance policy that is in accordance with AC-2, 2121. 2.) Audit trail of account maintenance activities.

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-000011.

Control	Description
AC-2	The organization: a: Identifies and selects the following types of information system accounts to support organizational missions/business functions: [organization-defined information system account types]; b: Assigns account managers for information system accounts; c: Establishes conditions for group and role membership; d: Specifies authorized users of the information system, group and role membership, and access authorizations (i.e., privileges) and other attributes (as required) for each account; e: Requires approvals by [organization-defined personnel or roles] for requests to create information system accounts; f: Creates, enables, modifies, disables, and removes information system accounts in accordance with [organization-defined procedures or conditions]; g: Monitors the use of information system accounts; h: Notifies account managers: 1: When accounts are no longer required; 2: When users are terminated or transferred; and 3: When individual information system usage or need-to-know changes; i: Authorizes access to the information system based on: 1: A valid access authorization; 2: Intended system usage; and 3: Other attributes as required by the organization or associated missions/business functions; j: Reviews accounts for compliance with account management requirements [organization-defined frequency]; and k: Establishes a process for reissuing shared/group account credentials (if deployed) when individuals are removed from the group.

Control

Description

AC-2

The organization:

a: Identifies and selects the following types of information system accounts to support organizational missions/business functions: [organization-defined information system account types];

b: Assigns account managers for information system accounts;

c: Establishes conditions for group and role membership;

d: Specifies authorized users of the information system, group and role membership, and access authorizations (i.e., privileges) and other attributes (as required) for each account;

e: Requires approvals by [organization-defined personnel or roles] for requests to create information system accounts;

f: Creates, enables, modifies, disables, and removes information system accounts in accordance with [organization-defined procedures or conditions];

g: Monitors the use of information system accounts;

h: Notifies account managers:
- 1: When accounts are no longer required;
- 2: When users are terminated or transferred; and
- 3: When individual information system usage or need-to-know changes;

i: Authorizes access to the information system based on:
- 1: A valid access authorization;
- 2: Intended system usage; and
- 3: Other attributes as required by the organization or associated missions/business functions;

j: Reviews accounts for compliance with account management requirements [organization-defined frequency]; and

k: Establishes a process for reissuing shared/group account credentials (if deployed) when individuals are removed from the group.