Navigate

AC-2 (13)

AC-2 (13): Disable Accounts For High-Risk Individuals

The organization disables accounts of users posing a significant risk within [Assignment: organization-defined time period] of discovery of the risk.

Supplemental

Users posing a significant risk to organizations include individuals for whom reliable evidence or intelligence indicates either the intention to use authorized access to information systems to cause harm or through whom adversaries will cause harm. Harm includes potential adverse impacts to organizational operations and assets, individuals, other organizations, or the Nation. Close coordination between authorizing officials, information system administrators, and human resource managers is essential in order for timely execution of this control enhancement.

CIA Levels
Confidentiality	low
Integrity	low
Availability	unknown

Overlays
Privacy (High), Privacy (Low), Privacy (Mod), Privacy (PHI)

Related Controls

The controls below (if any) were marked by NIST as being related to AC-2 (13).

Control	Description
PS-4	The organization, upon termination of individual employment: PS-4a.: Disables information system access within [Assignment: organization-defined time period]; PS-4b.: Terminates/revokes any authenticators/credentials associated with the individual; PS-4c.: Conducts exit interviews that include a discussion of [Assignment: organization-defined information security topics]; PS-4d.: Retrieves all security-related organizational information system-related property; PS-4e.: Retains access to organizational information and information systems formerly controlled by terminated individual; and PS-4f.: Notifies [Assignment: organization-defined personnel or roles] within [Assignment: organization-defined time period].

Control

Description

PS-4

The organization, upon termination of individual employment:

PS-4a.: Disables information system access within [Assignment: organization-defined time period];

PS-4b.: Terminates/revokes any authenticators/credentials associated with the individual;

PS-4c.: Conducts exit interviews that include a discussion of [Assignment: organization-defined information security topics];

PS-4d.: Retrieves all security-related organizational information system-related property;

PS-4e.: Retains access to organizational information and information systems formerly controlled by terminated individual; and

PS-4f.: Notifies [Assignment: organization-defined personnel or roles] within [Assignment: organization-defined time period].

Enhancements

The controls below (if any) add on to the requirements of AC-2 (13).

Control	Description
No controls

Related CCIs

The CCIs below are tied to AC-2 (13).

CCI	Definition
CCI-002150	The organization defines the time period within which the accounts of users posing a significant risk are to be disabled after discovery of the risk.
CCI-002151	The organization disables accounts of users posing a significant risk within an organization-defined time period of discovery of the risk.