AC-2(2)

Requirement

Automatically [Selection: remove; disable] temporary and emergency accounts after [Assignment: organization-defined time period for each type of account].

Discussion

Management of temporary and emergency accounts includes the removal or disabling of such accounts automatically after a predefined time period rather than at the convenience of the system administrator. Automatic removal or disabling of accounts provides a more consistent implementation.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Access control policy; procedures for addressing account management; system design documentation; system configuration settings and associated documentation; system-generated list of temporary accounts removed and/or disabled; system-generated list of emergency accounts removed and/or disabled; system audit records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with account management responsibilities; system/network administrators; organizational personnel with information security with information security responsibilities; system developers].

Test

[SELECT FROM: Automated mechanisms for implementing account management functions].

ID	Assessment Objectives
AC-02(02)	temporary and emergency accounts are automatically <AC-02(02)_ODP[01] SELECTED PARAMETER VALUE> after <AC-02(02)_ODP[02] time period>.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!