IA-2(5)

Requirement

When shared accounts or authenticators are employed, require users to be individually authenticated before granting access to the shared accounts or resources.

Discussion

Individual authentication prior to shared group authentication mitigates the risk of using group accounts or authenticators.

Title

Identification and Authentication (organizational Users) | Individual Authentication with Group Authentication
Family

Identification and Authentication
NIST 800-53B Baseline(s)
- High

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Identification and authentication policy; system security plan; procedures addressing user identification and authentication; system design documentation; system configuration settings and associated documentation; system audit records; list of system accounts; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with system operations responsibilities; organizational personnel with account management responsibilities; organizational personnel with information security responsibilities; system/network administrators; system developers].

Test

[SELECT FROM: Mechanisms supporting and/or implementing an authentication capability for group accounts].

ID	Assessment Objectives
IA-02(05)	users are required to be individually authenticated before granting access to the shared accounts or resources when shared accounts or authenticators are employed.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!