AC-2 Account Management

Control statement

a. Define and document the types of accounts allowed and specifically prohibited for use within the system;
    b. Assign account managers;
    c. Require {{ insert: param, ac-02_odp.01 }} for group and role membership;
    d. Specify:
        1. Authorized users of the system;
        2. Group and role membership; and
        3. Access authorizations (i.e., privileges) and {{ insert: param, ac-02_odp.02 }} for each account;
    e. Require approvals by {{ insert: param, ac-02_odp.03 }} for requests to create accounts;
    f. Create, enable, modify, disable, and remove accounts in accordance with {{ insert: param, ac-02_odp.04 }};
    g. Monitor the use of accounts;
    h. Notify account managers and {{ insert: param, ac-02_odp.05 }} within:
        1.  {{ insert: param, ac-02_odp.06 }} when accounts are no longer required;
        2.  {{ insert: param, ac-02_odp.07 }} when users are terminated or transferred; and
        3.  {{ insert: param, ac-02_odp.08 }} when system usage or need-to-know changes for an individual;
    i. Authorize access to the system based on:
        1. A valid access authorization;
        2. Intended system usage; and
        3.  {{ insert: param, ac-02_odp.09 }};
    j. Review accounts for compliance with account management requirements {{ insert: param, ac-02_odp.10 }};
    k. Establish and implement a process for changing shared or group account authenticators (if deployed) when individuals are removed from the group; and
    l. Align account management processes with personnel termination and transfer processes.

Parameter placeholders {{ insert: param, … }} reference FedRAMP-set values in the resolved profile. Full parameter map is preserved in the catalog database.

Covered by these Key Security Indicators