Find the exact control, technique, lesson, or book.

SP 800-53 Control NIST SP 800-53 AC-2

AC-2 — Account Management

Examples of system account types include individual, shared, group, system, guest, anonymous, emergency, developer, temporary, and service. Identification of authorized system users and the specification of access privileges reflect the requirements in other controls in the security plan. Users requiring administrative privileges on system accounts receive a

Defense Map Control Bare Metal Cyber AC-2

AC-2 — Account Management | Defense Map

Examples of system account types include individual, shared, group, system, guest, anonymous, emergency, developer, temporary, and service. Identification of authorized system users and the specification of access privileges reflect the requirements in other controls in the security plan. Users requiring administrative privileges on system accounts receive additional scrutiny by organizational personnel responsible…

SP 800-53 Enhancement NIST SP 800-53 AC-2(10) Withdrawn

AC-2(10) — Shared and Group Account Credential Change

NIST SP 800-53 enhancement AC-2(10) Shared and Group Account Credential Change.

SP 800-53 Enhancement NIST SP 800-53 AC-2(1)

AC-2(1) — Automated System Account Management

Automated system account management includes using automated mechanisms to create, enable, modify, disable, and remove accounts; notify account managers when an account is created, enabled, modified, disabled, or removed, or when users are terminated or transferred; monitor system account usage; and report atypical system account usage. Automated mechanisms

SP 800-53 Enhancement NIST SP 800-53 AC-2(11)

AC-2(11) — Usage Conditions

Specifying and enforcing usage conditions helps to enforce the principle of least privilege, increase user accountability, and enable effective account monitoring. Account monitoring includes alerts generated if the account is used in violation of organizational parameters. Organizations can describe specific conditions or circumstances under which system ac

SP 800-53 Enhancement NIST SP 800-53 AC-2(12)

AC-2(12) — Account Monitoring for Atypical Usage

Atypical usage includes accessing systems at certain times of the day or from locations that are not consistent with the normal usage patterns of individuals. Monitoring for atypical usage may reveal rogue behavior by individuals or an attack in progress. Account monitoring may inadvertently create privacy risks since data collected to identify atypical usag

SP 800-53 Enhancement NIST SP 800-53 AC-2(13)

AC-2(13) — Disable Accounts for High-risk Individuals

Users who pose a significant security and/or privacy risk include individuals for whom reliable evidence indicates either the intention to use authorized access to systems to cause harm or through whom adversaries will cause harm. Such harm includes adverse impacts to organizational operations, organizational assets, individuals, other organizations, or the

SP 800-53 Enhancement NIST SP 800-53 AC-2(2)

AC-2(2) — Automated Temporary and Emergency Account Management

Management of temporary and emergency accounts includes the removal or disabling of such accounts automatically after a predefined time period rather than at the convenience of the system administrator. Automatic removal or disabling of accounts provides a more consistent implementation.

SP 800-53 Enhancement NIST SP 800-53 AC-2(3)

AC-2(3) — Disable Accounts

Disabling expired, inactive, or otherwise anomalous accounts supports the concepts of least privilege and least functionality which reduce the attack surface of the system.

SP 800-53 Enhancement NIST SP 800-53 AC-2(4)

AC-2(4) — Automated Audit Actions

Account management audit records are defined in accordance with [AU-02](#au-2) and reviewed, analyzed, and reported in accordance with [AU-06](#au-6).

SP 800-53 Enhancement NIST SP 800-53 AC-2(5)

AC-2(5) — Inactivity Logout

Inactivity logout is behavior- or policy-based and requires users to take physical action to log out when they are expecting inactivity longer than the defined period. Automatic enforcement of inactivity logout is addressed by [AC-11](#ac-11).

SP 800-53 Enhancement NIST SP 800-53 AC-2(6)

AC-2(6) — Dynamic Privilege Management

In contrast to access control approaches that employ static accounts and predefined user privileges, dynamic access control approaches rely on runtime access control decisions facilitated by dynamic privilege management, such as attribute-based access control. While user identities remain relatively constant over time, user privileges typically change more f

SP 800-53 Enhancement NIST SP 800-53 AC-2(7)

AC-2(7) — Privileged User Accounts

Privileged roles are organization-defined roles assigned to individuals that allow those individuals to perform certain security-relevant functions that ordinary users are not authorized to perform. Privileged roles include key management, account management, database administration, system and network administration, and web administration. A role-based acc

SP 800-53 Enhancement NIST SP 800-53 AC-2(8)

AC-2(8) — Dynamic Account Management

Approaches for dynamically creating, activating, managing, and deactivating system accounts rely on automatically provisioning the accounts at runtime for entities that were previously unknown. Organizations plan for the dynamic management, creation, activation, and deactivation of system accounts by establishing trust relationships, business rules, and mech

SP 800-53 Enhancement NIST SP 800-53 AC-2(9)

AC-2(9) — Restrictions on Use of Shared and Group Accounts

Before permitting the use of shared or group accounts, organizations consider the increased risk due to the lack of accountability with such accounts.