AC-2(1)

Requirement

Support the management of system accounts using [Assignment: organization-defined automated mechanisms].

Discussion

Automated system account management includes using automated mechanisms to create, enable, modify, disable, and remove accounts; notify account managers when an account is created, enabled, modified, disabled, or removed, or when users are terminated or transferred; monitor system account usage; and report atypical system account usage. Automated mechanisms can include internal system functions and email, telephonic, and text messaging notifications.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Access control policy; procedures for addressing account management; system design documentation; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with account management responsibilities; system/network administrators; organizational personnel with information security with information security responsibilities; system developers].

Test

[SELECT FROM: Automated mechanisms for implementing account management functions].

ID	Assessment Objectives
AC-02(01)	the management of system accounts is supported using <AC-02(01)_ODP automated mechanisms>.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!