CCI-001829

Implementation Guidance

The organization being inspected/assessed reviews information system privileges every 90 days. The organization must maintain the reviews as an audit trail. DoD has defined the frequency as every 90 days.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the audit trail of reviews to ensure the organization being inspected/assessed reviews information system privileges every 90 days . DoD has defined the frequency as every 90 days.

Compelling Evidence

1.) Signed and dated documentation that defines a process to review information system privileges every 90 days 2.) Audit trail of reviews