Applicable

(Y)es / (N)o

(C)onfidentiality

(I)ntegrity

(A)vailability

RPN

(C+I+A)

(S)atisfactory

L1

M2

H3

L1

M2

H3

L1

M2

H3

(O)ther than satisfactory +##

ac-2(4)

account management  | automated audit actions

assessment objective:

Determine if:

ac-2(4)[1]

the information system automatically audits the following account actions:

ac-2(4)[1][a]

creation;

ac-2(4)[1][b]

modification;

ac-2(4)[1][c]

enabling;

ac-2(4)[1][d]

disabling;

ac-2(4)[1][e]

removal;

ac-2(4)[2]

the organization defines personnel or roles to be notified of the following account actions:

ac-2(4)[2][a]

creation;

ac-2(4)[2][b]

modification;

ac-2(4)[2][c]

enabling;

ac-2(4)[2][d]

disabling;

ac-2(4)[2][e]

removal;

ac-2(4)[3]

the information system notifies organization-defined personnel or roles of the following account actions:

ac-2(4)[3][a]

creation;

ac-2(4)[3][b]

modification;

ac-2(4)[3][c]

enabling;

ac-2(4)[3][d]

disabling; and

ac-2(4)[3][e]

removal.

potential assessment methods and objects:

Examine: [select from: Access control policy; procedures addressing account management; information system design documentation; information system configuration settings and associated documentation; notifications/alerts of account creation, modification, enabling, disabling, and removal actions; information system audit records; other relevant documents or records].

Interview: [select from: Organizational personnel with account management responsibilities; system/network administrators; organizational personnel with information security responsibilities].

Test: [select from: Automated mechanisms implementing account management functions].