AC-2 — Account Management | Bare Metal Cyber

Official NIST control content

Control statement

a.Define and document the types of accounts allowed and specifically prohibited for use within the system;
b.Assign account managers;
c.Require [Organization-defined: prerequisites and criteria] for group and role membership;
d.Specify:
1. 1.Authorized users of the system;
2. 2.Group and role membership; and
3. 3.Access authorizations (i.e., privileges) and [Organization-defined: attributes (as required)] for each account;
e.Require approvals by [Organization-defined: personnel or roles] for requests to create accounts;
f.Create, enable, modify, disable, and remove accounts in accordance with [Organization-defined: policy, procedures, prerequisites, and criteria];
g.Monitor the use of accounts;
h.Notify account managers and [Organization-defined: personnel or roles] within:
1. 1.[Organization-defined: time period] when accounts are no longer required;
2. 2.[Organization-defined: time period] when users are terminated or transferred; and
3. 3.[Organization-defined: time period] when system usage or need-to-know changes for an individual;
i.Authorize access to the system based on:
1. 1.A valid access authorization;
2. 2.Intended system usage; and
3. 3.[Organization-defined: attributes (as required)];
j.Review accounts for compliance with account management requirements [Organization-defined: frequency];
k.Establish and implement a process for changing shared or group account authenticators (if deployed) when individuals are removed from the group; and
l.Align account management processes with personnel termination and transfer processes.

Official NIST discussion

Discussion

Examples of system account types include individual, shared, group, system, guest, anonymous, emergency, developer, temporary, and service. Identification of authorized system users and the specification of access privileges reflect the requirements in other controls in the security plan. Users requiring administrative privileges on system accounts receive additional scrutiny by organizational personnel responsible for approving such accounts and privileged access, including system owner, mission or business owner, senior agency information security officer, or senior agency official for privacy. Types of accounts that organizations may wish to prohibit due to increased risk include shared, group, emergency, anonymous, temporary, and guest accounts. Where access involves personally identifiable information, security programs collaborate with the senior agency official for privacy to establish the specific conditions for group and role membership; specify authorized users, group and role membership, and access authorizations for each account; and create, adjust, or remove system accounts in accordance with organizational policies. Policies can include such information as account expiration dates or other factors that trigger the disabling of accounts. Organizations may choose to define access privileges or other attributes by account, type of account, or a combination of the two. Examples of other attributes required for authorizing access include restrictions on time of day, day of week, and point of origin. In defining other system account attributes, organizations consider system-related requirements and mission/business requirements. Failure to consider these factors could affect system availability. Temporary and emergency accounts are intended for short-term use. Organizations establish temporary accounts as part of normal account activation procedures when there is a need for short-term accounts without the demand for immediacy in account activation. Organizations establish emergency accounts in response to crisis situations and with the need for rapid account activation. Therefore, emergency account activation may bypass normal account authorization processes. Emergency and temporary accounts are not to be confused with infrequently used accounts, including local logon accounts used for special tasks or when network resources are unavailable (may also be known as accounts of last resort). Such accounts remain available and are not subject to automatic disabling or removal dates. Conditions for disabling or deactivating accounts include when shared/group, emergency, or temporary accounts are no longer required and when individuals are transferred or terminated. Changing shared/group authenticators when members leave the group is intended to ensure that former group members do not retain access to the shared or group account. Some types of system accounts may require specialized training.

Official OSCAL parameters

Organization-defined parameters

These values must be resolved through the organization’s tailoring and governance process. Bracketed parameter references in the control text identify where a decision is required.

prerequisites and criteriaprerequisites and criteria for group and role membership are defined;

attributes (as required)attributes (as required) for each account are defined;

personnel or rolespersonnel or roles required to approve requests to create accounts is/are defined;

policy, procedures, prerequisites, and criteriapolicy, procedures, prerequisites, and criteria for account creation, enabling, modification, disabling, and removal are defined;

personnel or rolespersonnel or roles to be notified is/are defined;

time periodtime period within which to notify account managers when accounts are no longer required is defined;

time periodtime period within which to notify account managers when users are terminated or transferred is defined;

time periodtime period within which to notify account managers when system usage or the need to know changes for an individual is defined;

attributes (as required)attributes needed to authorize system access (as required) are defined;

frequencythe frequency of account review is defined;

Original Bare Metal Cyber perspective

From control text to operational evidence

Use Account Management as a testable risk decision. Translate the official statement into accountable people, repeatable processes, configured technology, and evidence that demonstrates the outcome over time. In this family, pay particular attention to identity, authorization, least privilege, session boundaries, and access lifecycle governance.

Implementation workflow

Define the control boundary, responsible owner, inherited portions, and systems or processes in scope.
Resolve each organization-defined parameter before declaring the control implemented.
Document how the implementation satisfies every clause of the official control statement.
Collect evidence as a normal byproduct of operation rather than only before an assessment.
Review exceptions, changes, and monitoring results on a risk-based cadence.

Evidence examples

access approvals and entitlement records
role and group configuration exports
periodic access review results
authentication and authorization logs

Common failure patterns

standing privileges that outlive business need
shared or orphaned accounts
access rules implemented differently across systems
approvals that cannot be traced to actual permissions

Questions practitioners should ask

What risk decision is this control intended to support in this system?
Which parts are implemented locally, inherited, shared, or not applicable—and what evidence supports that decision?
Do the documented narrative, deployed configuration, operating process, and collected evidence agree?
What event or threshold requires the implementation to be reviewed or changed?

Official NIST SP 800-53A content

Assessment objectives and methods

Show the assessment objective

AC-02a.
1. AC-02a.[01]account types allowed for use within the system are defined and documented;
2. AC-02a.[02]account types specifically prohibited for use within the system are defined and documented;
AC-02b.account managers are assigned;
AC-02c.[Organization-defined: prerequisites and criteria] for group and role membership are required;
AC-02d.
1. AC-02d.01authorized users of the system are specified;
2. AC-02d.02group and role membership are specified;
3. AC-02d.03
  1. AC-02d.03[01]access authorizations (i.e., privileges) are specified for each account;
  2. AC-02d.03[02][Organization-defined: attributes (as required)] are specified for each account;
AC-02e.approvals are required by [Organization-defined: personnel or roles] for requests to create accounts;
AC-02f.
1. AC-02f.[01]accounts are created in accordance with [Organization-defined: policy, procedures, prerequisites, and criteria];
2. AC-02f.[02]accounts are enabled in accordance with [Organization-defined: policy, procedures, prerequisites, and criteria];
3. AC-02f.[03]accounts are modified in accordance with [Organization-defined: policy, procedures, prerequisites, and criteria];
4. AC-02f.[04]accounts are disabled in accordance with [Organization-defined: policy, procedures, prerequisites, and criteria];
5. AC-02f.[05]accounts are removed in accordance with [Organization-defined: policy, procedures, prerequisites, and criteria];
AC-02g.the use of accounts is monitored;
AC-02h.
1. AC-02h.01account managers and [Organization-defined: personnel or roles] are notified within [Organization-defined: time period] when accounts are no longer required;
2. AC-02h.02account managers and [Organization-defined: personnel or roles] are notified within [Organization-defined: time period] when users are terminated or transferred;
3. AC-02h.03account managers and [Organization-defined: personnel or roles] are notified within [Organization-defined: time period] when system usage or the need to know changes for an individual;
AC-02i.
1. AC-02i.01access to the system is authorized based on a valid access authorization;
2. AC-02i.02access to the system is authorized based on intended system usage;
3. AC-02i.03access to the system is authorized based on [Organization-defined: attributes (as required)];
AC-02j.accounts are reviewed for compliance with account management requirements [Organization-defined: frequency];
AC-02k.
1. AC-02k.[01]a process is established for changing shared or group account authenticators (if deployed) when individuals are removed from the group;
2. AC-02k.[02]a process is implemented for changing shared or group account authenticators (if deployed) when individuals are removed from the group;
AC-02l.
1. AC-02l.[01]account management processes are aligned with personnel termination processes;
2. AC-02l.[02]account management processes are aligned with personnel transfer processes.

Examine

Access control policy
personnel termination policy and procedure
personnel transfer policy and procedure
procedures for addressing account management
system design documentation
system configuration settings and associated documentation
list of active system accounts along with the name of the individual associated with each account
list of recently disabled system accounts and the name of the individual associated with each account
list of conditions for group and role membership
notifications of recent transfers, separations, or terminations of employees
access authorization records
account management compliance reviews
system monitoring records
system audit records
system security plan
privacy plan
other relevant documents or records

Interview

Organizational personnel with account management responsibilities
system/network administrators
organizational personnel with information security with information security and privacy responsibilities

Test

Organizational processes for account management on the system
mechanisms for implementing account management

Official relationships

Related controls

These relationships come from the official OSCAL catalog. They indicate useful dependencies or context, not automatic inheritance or equivalence.

MITRE D3FEND semantic mapping

Related defensive techniques

D3FEND maps this base control or one of its enhancements to the following defensive techniques. The ontology relation label is preserved and does not by itself prove implementation or effectiveness.

AC-2(1) · D3-ALAccount LockingControl is broader AC-2(1) · D3-MFAMulti-factor AuthenticationControl is broader AC-2(13) · D3-ALAccount LockingControl is narrower AC-2(2) · D3-ALAccount LockingControl is broader AC-2(3) · D3-ALAccount LockingControl is broader AC-2(4) · D3-DAMDomain Account MonitoringRelated AC-2(5) · D3-ALAccount LockingRelated AC-2(7) · D3-UAPUser Account PermissionsControl is narrower AC-2(9) · D3-UAPUser Account PermissionsControl is narrower

MITRE D3FEND™ and the D3FEND logo are trademarks of The MITRE Corporation. Bare Metal Cyber is not affiliated with or endorsed by MITRE.

Official CUI requirement crosswalk

Related NIST SP 800-171 requirements

These Rev. 3 requirements cite this base control or one of its enhancements as a source. The relationship does not by itself determine contractual applicability or complete implementation.

03.01.01Account ManagementAC-2(13) →

Official CUI requirement crosswalk

Related NIST SP 800-172 requirements

These Rev. 3 requirements cite this base control or one of its enhancements as a source. The relationship does not by itself determine contractual applicability or complete implementation.

03.01.07EAutomated Audit Actions for Account ManagementAC-2(4) →03.01.08EAccount Monitoring for Atypical UsageAC-2(12) →

Official NIST enhancements

Control enhancements

Enhancements add specificity, strength, or scope to the base control. Baseline badges show explicit selections in the official SP 800-53B OSCAL profiles.

Official NIST control enhancement

AC-2(1) — Automated System Account Management

ModerateHigh

Support the management of system accounts using [Organization-defined: automated mechanisms].

Official discussion

Automated system account management includes using automated mechanisms to create, enable, modify, disable, and remove accounts; notify account managers when an account is created, enabled, modified, disabled, or removed, or when users are terminated or transferred; monitor system account usage; and report atypical system account usage. Automated mechanisms can include internal system functions and email, telephonic, and text messaging notifications.

Organization-defined parameters (1)

automated mechanismsautomated mechanisms used to support the management of system accounts are defined;

Assessment objectives and methods

the management of system accounts is supported using [Organization-defined: automated mechanisms].

Examine

Access control policy
procedures for addressing account management
system design documentation
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records

Interview

Organizational personnel with account management responsibilities
system/network administrators
organizational personnel with information security with information security responsibilities
system developers

Test

Automated mechanisms for implementing account management functions

Official NIST control enhancement

AC-2(2) — Automated Temporary and Emergency Account Management

ModerateHigh

Automatically [Organization-defined: ac-02.02_odp.01] temporary and emergency accounts after [Organization-defined: time period].

Official discussion

Management of temporary and emergency accounts includes the removal or disabling of such accounts automatically after a predefined time period rather than at the convenience of the system administrator. Automatic removal or disabling of accounts provides a more consistent implementation.

Organization-defined parameters (2)

ac-02.02_odp.01

time periodthe time period after which to automatically remove or disable temporary or emergency accounts is defined;

Assessment objectives and methods

temporary and emergency accounts are automatically [Organization-defined: ac-02.02_odp.01] after [Organization-defined: time period].

Examine

Access control policy
procedures for addressing account management
system design documentation
system configuration settings and associated documentation
system-generated list of temporary accounts removed and/or disabled
system-generated list of emergency accounts removed and/or disabled
system audit records
system security plan
other relevant documents or records

Interview

Organizational personnel with account management responsibilities
system/network administrators
organizational personnel with information security with information security responsibilities
system developers

Test

Automated mechanisms for implementing account management functions

Official NIST control enhancement

AC-2(3) — Disable Accounts

ModerateHigh

Disable accounts within [Organization-defined: time period] when the accounts:

(a)Have expired;
(b)Are no longer associated with a user or individual;
(c)Are in violation of organizational policy; or
(d)Have been inactive for [Organization-defined: time period].

Official discussion

Disabling expired, inactive, or otherwise anomalous accounts supports the concepts of least privilege and least functionality which reduce the attack surface of the system.

Organization-defined parameters (2)

time periodtime period within which to disable accounts is defined;

time periodtime period for account inactivity before disabling is defined;

Assessment objectives and methods

AC-02(03)(a)accounts are disabled within [Organization-defined: time period] when the accounts have expired;
AC-02(03)(b)accounts are disabled within [Organization-defined: time period] when the accounts are no longer associated with a user or individual;
AC-02(03)(c)accounts are disabled within [Organization-defined: time period] when the accounts are in violation of organizational policy;
AC-02(03)(d)accounts are disabled within [Organization-defined: time period] when the accounts have been inactive for [Organization-defined: time period].

Examine

Access control policy
procedures for addressing account management
system security plan
system design documentation
system configuration settings and associated documentation
system-generated list of accounts removed
system-generated list of emergency accounts disabled
system audit records
system security plan
other relevant documents or records

Interview

Organizational personnel with account management responsibilities
system/network administrators
organizational personnel with information security responsibilities
system developers

Test

Mechanisms for implementing account management functions

Official NIST control enhancement

AC-2(4) — Automated Audit Actions

ModerateHigh

Automatically audit account creation, modification, enabling, disabling, and removal actions.

Official discussion

Account management audit records are defined in accordance with [AU-02](#au-2) and reviewed, analyzed, and reported in accordance with [AU-06](#au-6).

Assessment objectives and methods

AC-02(04)[01]account creation is automatically audited;
AC-02(04)[02]account modification is automatically audited;
AC-02(04)[03]account enabling is automatically audited;
AC-02(04)[04]account disabling is automatically audited;
AC-02(04)[05]account removal actions are automatically audited.

Examine

Access control policy
procedures addressing account management
system design documentation
system configuration settings and associated documentation
notifications/alerts of account creation, modification, enabling, disabling, and removal actions
system audit records
system security plan
other relevant documents or records

Interview

Organizational personnel with account management responsibilities
system/network administrators
organizational personnel with information security responsibilities

Test

Automated mechanisms implementing account management functions

Related controls

Official NIST control enhancement

AC-2(5) — Inactivity Logout

ModerateHigh

Require that users log out when [Organization-defined: time period of expected inactivity or description of when to log out].

Official discussion

Inactivity logout is behavior- or policy-based and requires users to take physical action to log out when they are expecting inactivity longer than the defined period. Automatic enforcement of inactivity logout is addressed by [AC-11](#ac-11).

Organization-defined parameters (1)

time period of expected inactivity or description of when to log outthe time period of expected inactivity or description of when to log out is defined;

Assessment objectives and methods

users are required to log out when [Organization-defined: time period of expected inactivity or description of when to log out].

Examine

Access control policy
procedures addressing account management
system design documentation
system configuration settings and associated documentation
security violation reports
system audit records
system security plan
other relevant documents or records

Interview

Organizational personnel with account management responsibilities
system/network administrators
organizational personnel with information security responsibilities
users that must comply with inactivity logout policy

Related controls

Official NIST control enhancement

AC-2(6) — Dynamic Privilege Management

Implement [Organization-defined: dynamic privilege management capabilities].

Official discussion

In contrast to access control approaches that employ static accounts and predefined user privileges, dynamic access control approaches rely on runtime access control decisions facilitated by dynamic privilege management, such as attribute-based access control. While user identities remain relatively constant over time, user privileges typically change more frequently based on ongoing mission or business requirements and the operational needs of organizations. An example of dynamic privilege management is the immediate revocation of privileges from users as opposed to requiring that users terminate and restart their sessions to reflect changes in privileges. Dynamic privilege management can also include mechanisms that change user privileges based on dynamic rules as opposed to editing specific user profiles. Examples include automatic adjustments of user privileges if they are operating out of their normal work times, if their job function or assignment changes, or if systems are under duress or in emergency situations. Dynamic privilege management includes the effects of privilege changes, for example, when there are changes to encryption keys used for communications.

Organization-defined parameters (1)

dynamic privilege management capabilitiesdynamic privilege management capabilities are defined;

Assessment objectives and methods

[Organization-defined: dynamic privilege management capabilities] are implemented.

Examine

Access control policy
procedures addressing account management
system design documentation
system configuration settings and associated documentation
system-generated list of dynamic privilege management capabilities
system audit records
system security plan
other relevant documents or records

Interview

Organizational personnel with account management responsibilities
system/network administrators
organizational personnel with information security responsibilities
system developers

Test

system or mechanisms implementing dynamic privilege management capabilities

Related controls

Official NIST control enhancement

AC-2(7) — Privileged User Accounts

(a)Establish and administer privileged user accounts in accordance with [Organization-defined: ac-02.07_odp];
(b)Monitor privileged role or attribute assignments;
(c)Monitor changes to roles or attributes; and
(d)Revoke access when privileged role or attribute assignments are no longer appropriate.

Official discussion

Privileged roles are organization-defined roles assigned to individuals that allow those individuals to perform certain security-relevant functions that ordinary users are not authorized to perform. Privileged roles include key management, account management, database administration, system and network administration, and web administration. A role-based access scheme organizes permitted system access and privileges into roles. In contrast, an attribute-based access scheme specifies allowed system access and privileges based on attributes.

Organization-defined parameters (1)

ac-02.07_odp

Assessment objectives and methods

AC-02(07)(a)privileged user accounts are established and administered in accordance with [Organization-defined: ac-02.07_odp];
AC-02(07)(b)privileged role or attribute assignments are monitored;
AC-02(07)(c)changes to roles or attributes are monitored;
AC-02(07)(d)access is revoked when privileged role or attribute assignments are no longer appropriate.

Examine

Access control policy
procedures addressing account management
system design documentation
system configuration settings and associated documentation
system-generated list of privileged user accounts and associated roles
records of actions taken when privileged role assignments are no longer appropriate
system audit records
audit tracking and monitoring reports
system monitoring records
system security plan
other relevant documents or records

Interview

Organizational personnel with account management responsibilities
system/network administrators
organizational personnel with information security responsibilities

Test

Mechanisms implementing account management functions
mechanisms monitoring privileged role assignments

Official NIST control enhancement

AC-2(8) — Dynamic Account Management

Create, activate, manage, and deactivate [Organization-defined: system accounts] dynamically.

Official discussion

Approaches for dynamically creating, activating, managing, and deactivating system accounts rely on automatically provisioning the accounts at runtime for entities that were previously unknown. Organizations plan for the dynamic management, creation, activation, and deactivation of system accounts by establishing trust relationships, business rules, and mechanisms with appropriate authorities to validate related authorizations and privileges.

Organization-defined parameters (1)

system accountssystem accounts that are dynamically created, activated, managed, and deactivated are defined;

Assessment objectives and methods

AC-02(08)[01][Organization-defined: system accounts] are created dynamically;
AC-02(08)[02][Organization-defined: system accounts] are activated dynamically;
AC-02(08)[03][Organization-defined: system accounts] are managed dynamically;
AC-02(08)[04][Organization-defined: system accounts] are deactivated dynamically.

Examine

Access control policy
procedures addressing account management
system design documentation
system configuration settings and associated documentation
system-generated list of system accounts
system audit records
system security plan
other relevant documents or records

Interview

Organizational personnel with account management responsibilities
system/network administrators
organizational personnel with information security responsibilities
system developers

Test

Automated mechanisms implementing account management functions

Related controls

Official NIST control enhancement

AC-2(9) — Restrictions on Use of Shared and Group Accounts

Only permit the use of shared and group accounts that meet [Organization-defined: conditions].

Official discussion

Before permitting the use of shared or group accounts, organizations consider the increased risk due to the lack of accountability with such accounts.

Organization-defined parameters (1)

conditionsconditions for establishing shared and group accounts are defined;

Assessment objectives and methods

the use of shared and group accounts is only permitted if [Organization-defined: conditions] are met.

Examine

Access control policy
procedures addressing account management
system design documentation
system configuration settings and associated documentation
system-generated list of shared/group accounts and associated roles
system audit records
system security plan
other relevant documents or records

Interview

Organizational personnel with account management responsibilities
system/network administrators
organizational personnel with information security responsibilities

Test

Mechanisms implementing management of shared/group accounts

Official NIST control enhancement

AC-2(10) — Shared and Group Account Credential Change

Withdrawn

This enhancement is marked withdrawn in the official OSCAL catalog. Related-control metadata below may identify where its intent was incorporated.

Official NIST control enhancement

AC-2(11) — Usage Conditions

High

Enforce [Organization-defined: circumstances and/or usage conditions] for [Organization-defined: system accounts].

Official discussion

Specifying and enforcing usage conditions helps to enforce the principle of least privilege, increase user accountability, and enable effective account monitoring. Account monitoring includes alerts generated if the account is used in violation of organizational parameters. Organizations can describe specific conditions or circumstances under which system accounts can be used, such as by restricting usage to certain days of the week, time of day, or specific durations of time.

Organization-defined parameters (2)

circumstances and/or usage conditionscircumstances and/or usage conditions to be enforced for system accounts are defined;

system accountssystem accounts subject to enforcement of circumstances and/or usage conditions are defined;

Assessment objectives and methods

[Organization-defined: circumstances and/or usage conditions] for [Organization-defined: system accounts] are enforced.

Examine

Access control policy
procedures addressing account management
system design documentation
system configuration settings and associated documentation
system-generated list of system accounts and associated assignments of usage circumstances and/or usage conditions
system audit records
system security plan
other relevant documents or records

Interview

Organizational personnel with account management responsibilities
system/network administrators
organizational personnel with information security responsibilities
system developers

Test

Mechanisms implementing account management functions

Official NIST control enhancement

AC-2(12) — Account Monitoring for Atypical Usage

High

(a)Monitor system accounts for [Organization-defined: atypical usage] ; and
(b)Report atypical usage of system accounts to [Organization-defined: personnel or roles].

Official discussion

Atypical usage includes accessing systems at certain times of the day or from locations that are not consistent with the normal usage patterns of individuals. Monitoring for atypical usage may reveal rogue behavior by individuals or an attack in progress. Account monitoring may inadvertently create privacy risks since data collected to identify atypical usage may reveal previously unknown information about the behavior of individuals. Organizations assess and document privacy risks from monitoring accounts for atypical usage in their privacy impact assessment and make determinations that are in alignment with their privacy program plan.

Organization-defined parameters (2)

atypical usageatypical usage for which to monitor system accounts is defined;

personnel or rolespersonnel or roles to report atypical usage is/are defined;

Assessment objectives and methods

AC-02(12)(a)system accounts are monitored for [Organization-defined: atypical usage];
AC-02(12)(b)atypical usage of system accounts is reported to [Organization-defined: personnel or roles].

Examine

Access control policy
procedures addressing account management
system design documentation
system configuration settings and associated documentation
system monitoring records
system audit records
audit tracking and monitoring reports
privacy impact assessment
system security plan
privacy plan
other relevant documents or records

Interview

Organizational personnel with account management responsibilities
system/network administrators
organizational personnel with information security responsibilities

Test

Mechanisms implementing account management functions

Related controls

Official NIST control enhancement

AC-2(13) — Disable Accounts for High-risk Individuals

ModerateHigh

Disable accounts of individuals within [Organization-defined: time period] of discovery of [Organization-defined: significant risks].

Official discussion

Users who pose a significant security and/or privacy risk include individuals for whom reliable evidence indicates either the intention to use authorized access to systems to cause harm or through whom adversaries will cause harm. Such harm includes adverse impacts to organizational operations, organizational assets, individuals, other organizations, or the Nation. Close coordination among system administrators, legal staff, human resource managers, and authorizing officials is essential when disabling system accounts for high-risk individuals.

Organization-defined parameters (2)

time periodtime period within which to disable accounts of individuals who are discovered to pose significant risk is defined;

significant riskssignificant risks leading to disabling accounts are defined;

Assessment objectives and methods

accounts of individuals are disabled within [Organization-defined: time period] of discovery of [Organization-defined: significant risks].

Examine

Access control policy
procedures addressing account management
system design documentation
system configuration settings and associated documentation
system-generated list of disabled accounts
list of user activities posing significant organizational risk
system audit records
system security plan
other relevant documents or records

Interview

Organizational personnel with account management responsibilities
system/network administrators
organizational personnel with information security responsibilities

Test

Mechanisms implementing account management functions

Related controls

Source record

Authoritative sources

Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by NIST. Official control requirements and interpretations remain with NIST and the responsible authorizing organization.