AC - Access Control

Custom intro or description for this control family can go here

Total Progress on 14 Items

Done 1010 Doing 130 Todo 260

AC-2 Account Management

Account Management

To Do: Example Link

Doing: Example Link

Done: Example Link

Read

AC-2(a)

Identifies and selects the following types of information system accounts to support organizational missions/business functions

To Do: or todos

Read

AC-2b

Assigns account managers for information system accounts

:

Read

AC-2c

Establishes conditions for group and role membership

:

Read

AC-2d

Specifies authorized users of the information system, group and role membership, and access authorizations (i.e., privileges) and other attributes (as required) for each account

:

Read

AC-2e

Requires approvals by [assignment] for requests to create information system accounts

:

Read

AC-2f

Creates, enables, modifies, disables, and removes information system accounts in accordance with organization-defined procedures or conditions

:

Read

AC-2g

Monitors the use of information system accounts

:

Read

AC-2h

Notifies account managers 1. When accounts are no longer required 2. When users are terminated or transferred 3. When individual information system usage or need-to-know changes

:

Read

AC-2i

Authorizes access to the information system based on 1. A valid access authorization 2. Intended system usage 3. Other attributes as required by the organization or associated missions/business functions.

:

Read

AC-2j

Reviews accounts for compliance with account management requirements organization-defined frequency

:

Read

AC-2k

Establishes a process for reissuing shared/group account credentials (if deployed) when individuals are removed from the group.

:

Read

AC-3 Access Enforcement

The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

:

Read

AC-6 Least Privilege

The organization General Federal Agency employs the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions.

:

Read