Control: The Organisation
H. Notifies account managers:
- When accounts are no longer required;
- When users are terminated or transferred; and
- When individual information system usage or need-to-know changes;
I. Authorises access to the information system based on:
- A valid access authorisation;
- Intended system usage; and
- Other attributes as required by the organisation or associated missions/business functions;
AC-2 Control Enhancements:
AC-2 (1) Account Management - Automated System Account Management
The organisation employs automated mechanisms to support the management of information system accounts.
AC-2 (2) Account Management - Removal of temporary / emergency contacts
The information system automatically [Selection: removes; disables] temporary and emergency accounts after [Assignment: organisation-defined time period for each type of account].
This control enhancement requires the removal of both temporary and emergency accounts automatically after a predefined period of time has elapsed, rather than at the convenience of the systems administrator.
AC-2 (3) Account Management - Disable Inactive Accounts
The information system automatically disables inactive accounts after [Assignment: organisation- defined time period].
AC-2 (5) Account Management - Inactivity Logout
The organisation requires that users log out when [Assignment: organisation-defined time-period of expected inactivity or description of when to log out].
Related control: SC-23
AC-2 (6) Account Management - Dynamic Privilege Management
The information system implements the following dynamic privilege management capabilities: [Assignment: organisation-defined list of dynamic privilege management capabilities].
In contrast to conventional access control approaches which employ static information system accounts and predefined sets of user privileges, dynamic access control approaches (e.g., service-oriented architectures) rely on run time access control decisions facilitated by dynamic privilege management. While user identities may remain relatively constant over time, user privileges may change more frequently based on ongoing mission/business requirements and operational needs of organisations. Dynamic privilege management can include, for example, the immediate revocation of privileges from users, as opposed to requiring that users terminate and restart their sessions to reflect any changes in privileges. Dynamic privilege management can also refer to mechanisms that change the privileges of users based on dynamic rules as opposed to editing specific user profiles. This type of privilege management includes, for example, automatic adjustments of privileges if users are operating out of their normal work times, or if information systems are under duress or in emergency maintenance situations. This control enhancement also includes the ancillary effects of privilege changes, for example, the potential changes to encryption keys used for communications. Dynamic privilege management can support requirements for information system resiliency.
Related control: AC-16.
AC-2 (7) Account Management - Role Based Schemes
The organisation:
(a) Establishes and administers privileged user accounts in accordance with a role-based access scheme that organises allowed information system access and privileges into roles;
(b) Monitors privileged role assignments; and
(c) Takes [Assignment: organisation-defined actions] when privileged role assignments are no longer appropriate.
Privileged roles are organisation-defined roles as signed to individuals that allow those individuals to perform certain security-relevant functions that ordinary users are not authorised to perform. These privileged roles include, for example, key management, account management, network and system administration, database administration, and web administration.
AC-2 (8) Account Management - Dynamic Account Creation
The information system creates [Assignment: organisation-defined information system accounts] dynamically.
Dynamic approaches for creating information system accounts (e.g.,as implemented within service-oriented architectures) rely on establishing accounts (identities) at run time for entities that were previously unknown. Organisations plan for dynamic creation of information system accounts by establishing trust relationships and mechanisms with the appropriate authorities to validate related authorisations and privileges.
Related control: AC-16.
AC-2 (9) Account Management - Restrictions on use of shared / group accounts
The organisation only permits the use of shared/group accounts that meet [Assignment: organisation-defined conditions for establishing shared/group accounts].
AC-2 (10) Account Management - Shared / group account credential termination
The information system terminates shared/group account credentials when members leave the group.
AC-2 (11) Account Management - Usage Conditions
The information system enforces [Assignment: organisation-defined circumstances and/or usage conditions] for [Assignment: organisation-defined information system accounts].
Organisations can describe the specific conditions or circumstances under which information system accounts can be used, for example, by restricting usage to certain days of the week, time of day, or specific durations of time.
AC-2 (12) Account Management - Account Monitoring / a typical usage
The organisation:
(a) Monitors information system accounts for [Assignment: organisation-defined a typical usage]; and
(b) Reports atypical usage of information system accounts to [Assignment: organisation-defined personnel or roles].
A typical usage includes, for example, accessing information systems at certain times of the day and from locations that are not consistent with the normal usage patterns of individuals working in organisations.
Related control: CA-7.
AC-2 (13) Account Management - Disable accounts for high risk individuals
The organisation disables accounts of users posing a significant risk within [Assignment: organisation-defined time period] of discovery of the risk.
Users posing a significant risk to organisations include individuals for whom reliable evidence or intelligence indicates either the intention to use authorised access to information systems to cause harm or through whom adversaries will cause harm. Harm includes potential adverse impacts to organisational operations and assets, individuals, other organisations, or the Nation. Close coordination between authorising officials, information system administrators, and human resource managers is essential in order for timely execution of this control enhancement.
Related control: PS-4.