AC-2(11)

Requirement

Enforce [Assignment: organization-defined circumstances and/or usage conditions] for [Assignment: organization-defined system accounts].

Discussion

Specifying and enforcing usage conditions helps to enforce the principle of least privilege, increase user accountability, and enable effective account monitoring. Account monitoring includes alerts generated if the account is used in violation of organizational parameters. Organizations can describe specific conditions or circumstances under which system accounts can be used, such as by restricting usage to certain days of the week, time of day, or specific durations of time.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Access control policy; procedures addressing account management; system design documentation; system configuration settings and associated documentation; system-generated list of system accounts and associated assignments of usage circumstances and/or usage conditions; system audit records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with account management responsibilities; system/network administrators; organizational personnel with information security responsibilities; system developers].

ID	Assessment Objectives
AC-02(11)	<AC-02(11)_ODP[01] circumstances and/or usage conditions> for <AC-02(11)_ODP[02] system accounts> are enforced.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!