AC-2 Account Management (L) (M) (H)

NIST 800-53 (r4) Control:

The organization:

a. Identifies and selects the following types of information system accounts to support organizational missions/business functions: [Assignment: organization-defined information system account types];

b. Assigns account managers for information system accounts;

c. Establishes conditions for group and role membership;

d. Specifies authorized users of the information system, group and role membership, and access authorizations (i.e., privileges) and other attributes (as required) for each account;

e. Requires approvals by [Assignment: organization-defined personnel or roles] for requests to create information system accounts;

f. Creates, enables, modifies, disables, and removes information system accounts in accordance with [Assignment: organization-defined procedures or conditions];

g. Monitors the use of, information system accounts;

h. Notifies account managers:

1. When accounts are no longer required;

2. When users are terminated or transferred; and

3. When individual information system usage or need-to-know changes;

i. Authorizes access to the information system based on:

1. A valid access authorization;

2. Intended system usage; and

3. Other attributes as required by the organization or associated missions/business functions;

j. Reviews accounts for compliance with account management requirements [FedRAMP Assignment: (L)(M) at least annually; (H) monthly for privileged accessed, every six (6) months for non-privileged access]; and

k. Establishes a process for reissuing shared/group account credentials (if deployed) when individuals are removed from the group.

NIST 800-53 (r4) Supplemental Guidance:

Information system account types include individual, shared, group, system, guest/anonymous, emergency, developer/manufacturer/vendor, temporary, and service. Some of the account management requirements listed above can be implemented by organizational information systems. The identification of authorized users of the information system and the specification of access privileges reflects the requirements in other security controls in the security plan. Users requiring administrative privileges on information system accounts receive additional scrutiny by appropriate organizational personnel (e.g., system owner, mission/business owner, or chief information security officer) responsible for approving such accounts and privileged access. Organizations may choose to define access privileges or other attributes by account, by type of account, or a combination of both. Other attributes required for authorizing access include, for example, restrictions on time-of-day, day-of-week, and point-of-origin. In defining other account attributes, organizations consider system-related requirements (e.g., scheduled maintenance, system upgrades) and mission/business requirements, (e.g., time zone differences, customer requirements, remote access to support travel requirements). Failure to consider these factors could affect information system availability. Temporary and emergency accounts are accounts intended for short-term use. Organizations establish temporary accounts as a part of normal account activation procedures when there is a need for short-term accounts without the demand for immediacy in account activation. Organizations establish emergency accounts in response to crisis situations and with the need for rapid account activation. Therefore, emergency account activation may bypass normal account authorization processes. Emergency and temporary accounts are not to be confused with infrequently used accounts (e.g., local logon accounts used for special tasks defined by organizations or when network resources are unavailable). Such accounts remain available and are not subject to automatic disabling or removal dates. Conditions for disabling or deactivating accounts include, for example: (i) when shared/group, emergency, or temporary accounts are no longer required; or (ii) when individuals are transferred or terminated. Some types of information system accounts may require specialized training. Related controls: AC-3, AC-4, AC-5, AC-6, AC-10, AC-17, AC-19, AC-20, AU-9, IA-2, IA-4, IA-5, IA-8, CM-5, CM-6, CM-11, MA-3, MA-4, MA-5, PL-4, SC-13.

References: None.

NIST 800-53 (r5) Discussion:

Examples of system account types include individual, shared, group, system, guest, anonymous, emergency, developer, temporary, and service. Identification of authorized system users and the specification of access privileges reflect the requirements in other controls in the security plan. Users requiring administrative privileges on system accounts receive additional scrutiny by organizational personnel responsible for approving such accounts and privileged access, including system owner, mission or business owner, senior agency information security officer, or senior agency official for privacy. Types of accounts that organizations may wish to prohibit due to increased risk include shared, group, emergency, anonymous, temporary, and guest accounts.

Where access involves personally identifiable information, security programs collaborate with the senior agency official for privacy to establish the specific conditions for group and role membership; specify authorized users, group and role membership, and access authorizations for each account; and create, adjust, or remove system accounts in accordance with organizational policies. Policies can include such information as account expiration dates or other factors that trigger the disabling of accounts. Organizations may choose to define access privileges or other attributes by account, type of account, or a combination of the two. Examples of other attributes required for authorizing access include restrictions on time of day, day of week, and point of origin. In defining other system account attributes, organizations consider system-related requirements and mission/business requirements. Failure to consider these factors could affect system availability.

Temporary and emergency accounts are intended for short-term use. Organizations establish temporary accounts as part of normal account activation procedures when there is a need for short-term accounts without the demand for immediacy in account activation. Organizations establish emergency accounts in response to crisis situations and with the need for rapid account activation. Therefore, emergency account activation may bypass normal account authorization processes. Emergency and temporary accounts are not to be confused with infrequently used accounts, including local logon accounts used for special tasks or when network resources are unavailable (may also be known as accounts of last resort). Such accounts remain available and are not subject to automatic disabling or removal dates. Conditions for disabling or deactivating accounts include when shared/group, emergency, or temporary accounts are no longer required and when individuals are transferred or terminated. Changing shared/group authenticators when members leave the group is intended to ensure that former group members do not retain access to the shared or group account. Some types of system accounts may require specialized training.

38North Guidance:

Meets Minimum Requirement:

• Identify and select organization-defined information system account types to support organizational missions/business functions.

• Account managers assigned for all system accounts within the FedRAMP boundary.

• Require approvals by organization-defined personnel or roles for requests to create information system accounts.

• Account management processes for creating, enabling, modifying, disabling, & removing information system accounts.

• Monitor the use of information system accounts.

• Account managers are notified when accounts are no long required, when users are transferred, & when individual information system usage or need to know changes are conducted.

• Authorizes access to the information system based: a valid access authorization, intended system usage, & other attributes as required by the organization or associated missions/business functions.

• Review accounts for compliance with account management requirements with the organization-defined frequency.

Best Practice:

• Clearly defined role-based access for each individual that has access within the FedRAMP boundary only permitting each individual the access required by their role.

• Account managers assigned for information system accounts utilizing a ticketing system to document all account creations, transfers, & disabling/termination of accounts.

• Clear demonstration of the account approval process for creating all account creation, enabling accounts, modifying accounts, disabling & removing system accounts

within the FedRAMP boundary.

• Monitoring all account activity should be conducted by utilizing a SIEM tool such as SPLUNK, QRadar etc. to collect all account creation, enabling, modifying & disabling of accounts. Dashboards monitored by SOC personnel should be implemented within the environment.

• Clear defined processes in place for terminating & deactivating accounts or when modifications to accounts are required based on need to know, role, or permission changes. This should include email notifications etc of all account activity.

• Rules of Behavior (RoB) or Acceptable Use Policy (AuP) must be signed and dated by new individuals before accounts are enabled for new individuals access the FedRAMP boundary. The access agreements must clearly state what should and should not be conducted when accessing the system.

• Account reviews need to be demonstrated that they are conducted annually for low & moderate systems. High systems need to be reviewed every 6 months for non-privileged access and monthly for privileged accessed.

Unofficial FedRAMP Guidance: None

Assessment Evidence:

• Full listing of all account types & role-based access including who has access to which groups within the FedRAMP boundary.

• Samples of tickets and email notifications demonstrating accounts being created or disabled/terminated with approval by account managers.

• Samples of tickets demonstrating the approval process for account creation, account, enabling, account modification, account transfers, & account disabling/termination

• Email notifications of account management actions being conducted for all account activity within the FedRAMP boundary.

• Account monitoring demonstrated by audit logs ingested into the SIEM tool, SIEM dashboards, SIEM audit log reports, etc. SOC demonstrating monitoring of all system account activity being conducted within the environment.

• Samples of new individuals signed & dated RoB and or AUP and corresponding audit logs/tickets showing new accounts were not enabled until the signed RoB and or AUP was received.

• Demonstration of account reviews being conducted by way of emails, tickets, etc. for the information system are conducted annually for low & moderate systems and every 6 months for high systems.

CSP Implementation Tips:

• Amazon Web Services (AWS): TBD

• Microsoft Azure: TBD

• Google Cloud Platform: TBD