AC-2 Access Control

Account Management

Medium Priority Intermediate Level NIST CSF

The organization manages information system accounts, including establishing, activating, modifying, disabling, and removing accounts.

Implementation Guidance

Implement automated account management processes where possible. Establish procedures for account creation, modification, and termination. Conduct regular account reviews.

Best Practices

Implement automated account provisioning, conduct quarterly account reviews, maintain account lifecycle documentation

Testing Procedures

Test account creation and modification processes, verify account review procedures, check for orphaned accounts

Related Guidelines

AC-1, AC-3, AC-4, AC-5, AC-6