Eleos | Home

Access Control (AC)

Policy and Procedures

Level N/A

a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): Organization-level; Mission/business process-level; System-level] access control policy that: (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and 2. Procedures to facilitate the implementation of the access control policy and the associated access controls; b. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the access control policy and procedures; and c. Review and update the current access control: 1. Policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]; and 2. Procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events].

Parent

Compliance Framework

NIST 800-53 Rev 5

Control Number

AC-1

Related

Compliance Framework

CCM v4.0.10

Secure Controls Framework 2023.4

Control Number

DCS-02

GRC-01

HRS-09

IAM-01

IVS-01

GOV-02

GOV-03

IAC-01

Solutions
Community

Access Control (AC)

Account Management

Level N/A

a. Define and document the types of accounts allowed and specifically prohibited for use within the system; b. Assign account managers; c. Require [Assignment: organization-defined prerequisites and criteria] for group and role membership; d. Specify: 1. Authorized users of the system; 2. Group and role membership; and 3. Access authorizations (i.e., privileges) and [Assignment: organization-defined attributes (as required)] for each account; e. Require approvals by [Assignment: organization-defined personnel or roles] for requests to create accounts; f. Create, enable, modify, disable, and remove accounts in accordance with [Assignment: organization-defined policy, procedures, prerequisites, and criteria]; g. Monitor the use of accounts; h. Notify account managers and [Assignment: organization-defined personnel or roles] within: 1. [Assignment: organization-defined time period] when accounts are no longer required; 2. [Assignment: organization-defined time period] when users are terminated or transferred; and 3. [Assignment: organization-defined time period] when system usage or need-to-know changes for an individual; i. Authorize access to the system based on: 1. A valid access authorization; 2. Intended system usage; and 3. [Assignment: organization-defined attributes (as required)]; j. Review accounts for compliance with account management requirements [Assignment: organization-defined frequency]; k. Establish and implement a process for changing shared or group account authenticators (if deployed) when individuals are removed from the group; and l. Align account management processes with personnel termination and transfer processes.

Parent

Compliance Framework

NIST 800-53 Rev 5

Control Number

AC-2

Related

Compliance Framework

CCM v4.0.10

Secure Controls Framework 2023.4

Control Number

IAM-01

IAM-02

IAM-04

IAM-07

IAM-10

IAM-12

IAC-07.2

IAC-15

NET-12

TDA-18

Solutions
Community

Access Control (AC)

Account Management | Automated System Account Management

Level N/A

Support the management of system accounts using [Assignment: organization-defined automated mechanisms].

Parent

Compliance Framework

NIST 800-53 Rev 5

Control Number

AC-2(1)

Related

Compliance Framework

CCM v4.0.10

Secure Controls Framework 2023.4

CIS v8.0

Control Number

IAM-07

IAC-15.1

6.1

Solutions
Community

Access Control (AC)

Account Management | Automated Temporary and Emergency Account Management

Level N/A

Automatically [Selection: remove; disable] temporary and emergency accounts after [Assignment: organization-defined time period for each type of account].

Parent

Compliance Framework

NIST 800-53 Rev 5

Control Number

AC-2(2)

Related

Compliance Framework

CCM v4.0.10

Secure Controls Framework 2023.4

Control Number

IAM-07

IAC-15.2

Solutions
Community

Access Control (AC)

Account Management | Disable Accounts

Level N/A

Disable accounts within [Assignment: organization-defined time period] when the accounts: (a) Have expired; (b) Are no longer associated with a user or individual; (c) Are in violation of organizational policy; or (d) Have been inactive for [Assignment: organization-defined time period].

Parent

Compliance Framework

NIST 800-53 Rev 5

Control Number

AC-2(3)

Related

Compliance Framework

CCM v4.0.10

Secure Controls Framework 2023.4

Control Number

IAM-01

IAM-02

IAM-04

IAC-15.3

Solutions
Community

Access Control (AC)

Account Management | Automated Audit Actions

Level N/A

Automatically audit account creation, modification, enabling, disabling, and removal actions.

Parent

Compliance Framework

NIST 800-53 Rev 5

Control Number

AC-2(4)

Related

Compliance Framework

Secure Controls Framework 2023.4

Control Number

IAC-15.4

Solutions
Community

Access Control (AC)

Account Management | Inactivity Logout

Level N/A

Require that users log out when [Assignment: organization-defined time period of expected inactivity or description of when to log out].

Parent

Compliance Framework

NIST 800-53 Rev 5

Control Number

AC-2(5)

Related

Compliance Framework

Secure Controls Framework 2023.4

CIS v8.0

Control Number

IAC-24

4.3

Solutions
Community

Access Control (AC)

Account Management | Dynamic Privilege Management

Level N/A

Implement [Assignment: organization-defined dynamic privilege management capabilities].

Parent

Compliance Framework

NIST 800-53 Rev 5

Control Number

AC-2(6)

Related

Compliance Framework

CCM v4.0.10

Control Number

IAM-07

Solutions
Community

Access Control (AC)

Account Management | Privileged User Accounts

Level N/A

(a) Establish and administer privileged user accounts in accordance with [Selection: a role-based access scheme; an attribute-based access scheme]; (b) Monitor privileged role or attribute assignments; (c) Monitor changes to roles or attributes; and (d) Revoke access when privileged role or attribute assignments are no longer appropriate.

Parent

Compliance Framework

NIST 800-53 Rev 5

Control Number

AC-2(7)

Related

Compliance Framework

CCM v4.0.10

Secure Controls Framework 2023.4

Control Number

IAM-10

IAC-08

Solutions
Community

Access Control (AC)

Create new POAM

Create new Exception

Assign to POAM

Assign to Exception

Access Control (AC)

Create new POAM

Create new Exception

Assign to POAM

Assign to Exception

Access Control (AC)

Create new POAM

Create new Exception

Assign to POAM

Assign to Exception

Access Control (AC)

Create new POAM

Create new Exception

Assign to POAM

Assign to Exception

Access Control (AC)

Create new POAM

Create new Exception

Assign to POAM

Assign to Exception

Access Control (AC)

Create new POAM

Create new Exception

Assign to POAM

Assign to Exception

Access Control (AC)

Create new POAM

Create new Exception

Assign to POAM

Assign to Exception

Access Control (AC)

Create new POAM

Create new Exception

Assign to POAM

Assign to Exception

Access Control (AC)

Create new POAM

Create new Exception

Assign to POAM

Assign to Exception

Access Control (AC)

Create new POAM

Create new Exception

Assign to POAM

Assign to Exception

Organization Passcode

Only share this code with people you trust. Users will become a member of your organization and view your SSP and reports.