CCI-004045

Require users to be individually authenticated before granting access to the shared accounts or resources.

Implementation Guidance

Determine if users are required to be individually authenticated before granting access to the shared accounts or resources when shared accounts or authenticators are employed.

Validation Procedures

Examine: [SELECT FROM: Identification and authentication policy; system security plan; procedures addressing user identification and authentication; system design documentation; system configuration settings and associated documentation; system audit records; list of system accounts; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with system operations responsibilities; organizational personnel with account management responsibilities; organizational personnel with information security responsibilities; system/network administrators; system developers]. Test: [SELECT FROM: Mechanisms supporting and/or implementing an authentication capability for group accounts].

The controls below (if any) were marked by NIST as being related to CCI-004045.