CCI-002121

The organization defines the procedures or conditions to be employed when creating, enabling, modifying, disabling, and removing information system accounts.

Implementation Guidance

The organization being inspected/assessed defines and documents the procedures or conditions to be employed when creating, enabling, modifying, disabling, and removing information system accounts. DoD has determined the procedures or conditions are not appropriate to define at the Enterprise level.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented procedures or conditions to ensure the organization being inspected/assessed defines the procedures or conditions to be employed when creating, enabling, modifying, disabling, and removing information system accounts. DoD has determined the procedures or conditions are not appropriate to define at the Enterprise level.

Compelling Evidence

1.) Signed and dated copy of access control policy and/or account maintenance policy, referencing section that defines the procedures or conditions to be employed when creating, enabling, modifying, disabling, and removing information system accounts.

The controls below (if any) were marked by NIST as being related to CCI-002121.