AC-02 Account Management
Access Control
Description
a. Define and document the types of accounts allowed and specifically prohibited for use within the system; b. Assign account managers; c. Require [Assignment: organization-defined prerequisites and criteria] for group and role membership; d. Specify: 1. Authorized users of the system; 2. Group and role membership; and 3. Access authorizations (i.e., privileges) and [Assignment: organization-defined attributes (as required)] for each account; e. Require approvals by [Assignment: organization-defined personnel or roles] for requests to create accounts; f. Create, enable, modify, disable, and remove accounts in accordance with [Assignment: organization-defined policy, procedures, prerequisites, and criteria]; g. Monitor the use of accounts; h. Notify account managers and [Assignment: organization-defined personnel or roles] within: 1. [Assignment: organization-defined time period] when accounts are no longer required; 2. [Assignment: organization-defined time period] when users are terminated or transferred; and 3. [Assignment: organization-defined time period] when system usage or need-to-know changes for an individual; i. Authorize access to the system based on: 1. A valid access authorization; 2. Intended system usage; and 3. [Assignment: organization-defined attributes (as required)]; j. Review accounts for compliance with account management requirements [Assignment: organization-defined frequency]; k. Establish and implement a process for changing shared or group account authenticators (if deployed) when individuals are removed from the group; and l. Align account management processes with personnel termination and transfer processes.
Supplemental Guidance
Examples of system account types include individual, shared, group, system, guest, anonymous, emergency, developer, temporary, and service. Identification of authorized system users and the specification of access privileges reflect the requirements in other controls in the security plan. Users requiring administrative privileges on system accounts receive additional scrutiny by organizational personnel responsible for approving such accounts and privileged access, including system owner, mission or business owner, senior agency information security officer, or senior agency official for privacy. Types of accounts that organizations may wish to prohibit due to increased risk include shared, group, emergency, anonymous, temporary, and guest accounts. Where access involves personally identifiable information, security programs collaborate with the senior agency official for privacy to establish the specific conditions for group and role membership; specify authorized users, group and role membership, and access authorizations for each account; and create, adjust, or remove system accounts in accordance with organizational policies. Policies can include such information as account expiration dates or other factors that trigger the disabling of accounts. Organizations may choose to define access privileges or other attributes by account, type of account, or a combination of the two. Examples of other attributes required for authorizing access include restrictions on time of day, day of week, and point of origin. In defining other system account attributes, organizations consider system-related requirements and mission/business requirements. Failure to consider these factors could affect system availability. Temporary and emergency accounts are intended for short-term use. Organizations establish temporary accounts as part of normal account activation procedures when there is a need for short-term accounts without the demand for immediacy in account activation. Organizations establish emergency accounts in response to crisis situations and with the need for rapid account activation. Therefore, emergency account activation may bypass normal account authorization processes. Emergency and temporary accounts are not to be confused with infrequently used accounts, including local logon accounts used for special tasks or when network resources are unavailable (may also be known as accounts of last resort). Such accounts remain available and are not subject to automatic disabling or removal dates. Conditions for disabling or deactivating accounts include when shared/group, emergency, or temporary accounts are no longer required and when individuals are transferred or terminated. Changing shared/group authenticators when members leave the group is intended to ensure that former group members do not retain access to the shared or group account. Some types of system accounts may require specialized training.
Changes from Rev 4
Removes parameter for system account types Adds prerequisite and criteria parameter for group and role membership Adds access authorizations parameter for attributes (as required) for each account Adds parameters to notify account managers and organization-defined personnel or roles within time-period when accounts are no longer required; when users are terminated or transferred; and when system usage or need-to-know changes for an individual Adds control text with a new parameter requiring authorize access to the system based on a valid access authorization, intended system usage; and attributes (as required) Adds control text requiring alignment of account management processes with personnel termination and transfer processes Incorporates withdrawn control AC-02(10)
Enhancements (12)
What NIST adds to this control. Select one to read its statement.
AC-02(01) Automated System Account Management ModerateHigh
Support the management of system accounts using [Assignment: organization-defined automated mechanisms].
AC-02(02) Automated Temporary and Emergency Account Management ModerateHigh
Automatically [Selection (one): remove; disable] temporary and emergency accounts after [Assignment: organization-defined time period for each type of account].
AC-02(03) Disable Accounts ModerateHigh
Disable accounts within [Assignment: organization-defined time period] when the accounts: a. Have expired; b. Are no longer associated with a user or individual; c. Are in violation of organizational policy; or d. Have been inactive for [Assignment: organization-defined time period].
AC-02(04) Automated Audit Actions ModerateHigh
Automatically audit account creation, modification, enabling, disabling, and removal actions.
AC-02(05) Inactivity Logout ModerateHigh
Require that users log out when [Assignment: organization-defined time period of expected inactivity or description of when to log out].
AC-02(06) Dynamic Privilege Management
Implement [Assignment: organization-defined dynamic privilege management capabilities].
AC-02(07) Privileged User Accounts
a. Establish and administer privileged user accounts in accordance with [Selection (one): a role-based access scheme; an attribute-based access scheme]; b. Monitor privileged role or attribute assignments; c. Monitor changes to roles or attributes; and d. Revoke access when privileged role or attribute assignments are no longer appropriate.
AC-02(08) Dynamic Account Management
Create, activate, manage, and deactivate [Assignment: organization-defined system accounts] dynamically.
AC-02(09) Restrictions on Use of Shared and Group Accounts
Only permit the use of shared and group accounts that meet [Assignment: organization-defined conditions for establishing shared and group accounts].
AC-02(11) Usage Conditions High
Enforce [Assignment: organization-defined circumstances and/or usage conditions] for [Assignment: organization-defined system accounts].
AC-02(12) Account Monitoring for Atypical Usage High
a. Monitor system accounts for [Assignment: organization-defined atypical usage]; and b. Report atypical usage of system accounts to [Assignment: organization-defined personnel or roles].
AC-02(13) Disable Accounts for High-risk Individuals ModerateHigh
Disable accounts of individuals within [Assignment: organization-defined time period] of discovery of [Assignment: organization-defined significant risks].
Withdrawn by NIST:
- AC-02(10) Shared and Group Account Credential Change, now in AC-02
Patterns that use this control (17)
Grouped by the emphasis each pattern gives it.
Critical (9)
- SP-011 Cloud Computing Pattern
- SP-019 Secure Ad-Hoc File Exchange Pattern
- SP-021 Realtime Collaboration Pattern
- SP-022 Board of Directors Room
- SP-026 PCI Full Environment
- SP-029 Zero Trust Architecture
- SP-032 Modern Authentication
- SP-037 Privileged User Management
- SP-044 SaaS Identity Lifecycle Management
MITRE ATT&CK Techniques (220)
ATT&CK v16.1Techniques mitigated by this control, mapped via CTID.