CCI-002227

Implementation Guidance

The organization being inspected/assessed implements a process to only provide privileged accounts on the information system to personnel or roles defined in AC-6 (5), CCI 2226.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines a sampling of information system access authorizations to ensure the organization being inspected/assessed implements a process to only provide privileged accounts on the information system to personnel or roles defined in AC-6 (5), CCI 2226.

Compelling Evidence

1.) Signed and dated access control policy 2.) Signed and dated system security plan (SSP) 3.) Copy of privileged user agreement 4.) Applicable STIG/SRG checks