Navigate

CCI-002129

CCI-002129 Definition

Establish and implement a process for changing shared or group account authenticators (if deployed) when individuals are removed from the group.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

The organization being inspected/assessed includes in the account management procedures a process for reissuing shared/group account credentials (if deployed) when individuals are removed from the group.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the account management procedures to ensure the organization being inspected/assessed includes in the account management procedures a process for reissuing shared/group account credentials (if deployed) when individuals are removed from the group.

Compelling Evidence

1.) Signed and dated documentation that defines the process for reissuing shared/group account credentials when individuals are removed from the group.

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-002129.

Control	Description
AC-2	The organization: a: Identifies and selects the following types of information system accounts to support organizational missions/business functions: [organization-defined information system account types]; b: Assigns account managers for information system accounts; c: Establishes conditions for group and role membership; d: Specifies authorized users of the information system, group and role membership, and access authorizations (i.e., privileges) and other attributes (as required) for each account; e: Requires approvals by [organization-defined personnel or roles] for requests to create information system accounts; f: Creates, enables, modifies, disables, and removes information system accounts in accordance with [organization-defined procedures or conditions]; g: Monitors the use of information system accounts; h: Notifies account managers: 1: When accounts are no longer required; 2: When users are terminated or transferred; and 3: When individual information system usage or need-to-know changes; i: Authorizes access to the information system based on: 1: A valid access authorization; 2: Intended system usage; and 3: Other attributes as required by the organization or associated missions/business functions; j: Reviews accounts for compliance with account management requirements [organization-defined frequency]; and k: Establishes a process for reissuing shared/group account credentials (if deployed) when individuals are removed from the group.

Control

Description

AC-2

The organization:

a: Identifies and selects the following types of information system accounts to support organizational missions/business functions: [organization-defined information system account types];

b: Assigns account managers for information system accounts;

c: Establishes conditions for group and role membership;

d: Specifies authorized users of the information system, group and role membership, and access authorizations (i.e., privileges) and other attributes (as required) for each account;

e: Requires approvals by [organization-defined personnel or roles] for requests to create information system accounts;

f: Creates, enables, modifies, disables, and removes information system accounts in accordance with [organization-defined procedures or conditions];

g: Monitors the use of information system accounts;

h: Notifies account managers:
- 1: When accounts are no longer required;
- 2: When users are terminated or transferred; and
- 3: When individual information system usage or need-to-know changes;

i: Authorizes access to the information system based on:
- 1: A valid access authorization;
- 2: Intended system usage; and
- 3: Other attributes as required by the organization or associated missions/business functions;

j: Reviews accounts for compliance with account management requirements [organization-defined frequency]; and

k: Establishes a process for reissuing shared/group account credentials (if deployed) when individuals are removed from the group.