Device Class 3: Account Management

Control ID: AC-2 Account Management Family: Access Control Source: NIST 800-53r4
Control: The organization:
  • Identifies and selects the following types of information system accounts to support organizational missions/business functions: [Assignment: organization-defined information system account types];
  • Assigns account managers for information system accounts;
  • Establishes conditions for group and role membership;
  • Specifies authorized users of the information system, group and role membership, and access authorizations (i.e.,
  • privileges) and other attributes (as required) for each account;
  • Requires approvals by [Assignment: organization-defined personnel or roles] for requests to create information system accounts;
  • Creates, enables, modifies, disables, and removes information system accounts in accordance with [Assignment: organization-defined procedures or conditions];
  • Monitors the use of information system accounts;
  • Notifies account managers:
    1. When accounts are no longer required;
    2. When users are terminated or transferred; and
    3. When individual information system usage or need-to-know changes;
    4. Authorizes access to the information system based on:
    5. A valid access authorization;
    6. Intended system usage; and
    7. Other attributes as required by the organization or associated missions/business functions;
    8. Reviews accounts for compliance with account management requirements [Assignment: organization-defined frequency]; and
    9. Establishes a process for reissuing shared/group account credentials (if deployed) when individuals are removed from the group.
Supplemental Guidance:
Information system account types include, for example, individual, shared, group, system, guest/anonymous, emergency, developer/manufacturer/vendor, temporary, and service. Some of the account management requirements listed above can be implemented by organizational information systems. The identification of authorized users of the information system and the specification of access privileges reflects the requirements in other security controls in the security plan. Users requiring administrative privileges on information system accounts receive additional scrutiny by appropriate organizational personnel (e.g., system owner, mission/business owner, or chief information security officer) responsible for approving such accounts and privileged access. Organizations may choose to define access privileges or other attributes by account, by type of account, or a combination of both. Other attributes required for authorizing access include, for example, restrictions on time-of-day, day-of-week, and point-of-origin. In defining other account attributes, organizations consider system-related requirements (e.g., scheduled maintenance, system upgrades) and mission/business requirements, (e.g., time zone differences, customer requirements, remote access to support travel requirements). Failure to consider these factors could affect information system availability. Temporary and emergency accounts are accounts intended for short-term use. Organizations establish temporary accounts as a part of normal account activation procedures when there is a need for short-term accounts without the demand for immediacy in account activation. Organizations establish emergency accounts in response to crisis situations and with the need for rapid account activation. Therefore, emergency account activation may bypass normal account authorization processes. Emergency and temporary accounts are not to be confused with infrequently used accounts (e.g., local logon accounts used for special tasks defined by organizations or when network resources are unavailable). Such accounts remain available and are not subject to automatic disabling or removal dates. Conditions for disabling or deactivating accounts include, for example: (i) when shared/group, emergency, or temporary accounts are no longer required; or (ii) when individuals are transferred or terminated. Some types of information system accounts may require specialized training.

Related Controls: AC-3, AC-4, AC-5, AC-6, AC-10, AC-17, AC-19, AC-20, AU-9, CM-5, CM-6, CM-11, IA-2, IA-4, IA-5, MA-3, MA-4, MA-5, PL-4, SC-13, IA-8
Control Enhancements:
(5) Account Management | Inactivity Logout
The organization requires that users log out when [Assignment: organization-defined time-period of expected inactivity or description of when to log out].
Supplemental Guidance:
Related Controls: N/A

(11) Account Management | Usage Conditions
The information system enforces [Assignment: organization-defined circumstances and/or usage conditions] for [Assignment: organization-defined information system accounts].
Supplemental Guidance: Organizations can describe the specific conditions or circumstances under which information system accounts can be used, for example, by restricting usage to certain days of the week, time of day, or specific durations of time.
Related Controls: CA-7

(12) Account Management | Account Monitoring / Atypical Usage
The organization:
  • Monitors information system accounts for [Assignment: organization-defined atypical usage]; and
  • Reports atypical usage of information system accounts to [Assignment: organization-defined personnel or roles].

Supplemental Guidance: Atypical usage includes, for example, accessing information systems at certain times of the day and from locations that are not consistent with the normal usage patterns of individuals working in organizations.
Related Controls: CA-7
References: N/A
Mechanisms:

  • The device will automatically terminate a user's session after a reasonably short period of time consistent with industry best practices and the sensitivity of the user session. In most cases 5-15 minutes is reasonable.
  • Often attackers will leverage compromised user accounts when they know they will not be authenticated. Consider restricting access to some aspects of corporate accounts or prevent users from logging in while they are on vacation, in off hours or over holidays.
  • Having the capability to restrict user access to various systems when they are being serviced or updated can also be a handy feature to ensure that information system data integrity is preserved during system maintenance.
  • The organization will employ a wide range of heuristics to monitor and report on user activity.Common heuristics to look for including source location, source device identifiers, time of day heuristics, typical usage behaviors, and abnormalities in file access or a-typical download sizes.

Protocol Implementation Conformance Statements:
ID Statement Status Reference Notes
AC-2/1 Automatically terminates a user's session after a period of inactivity M Define time for termination