NIST SP 800-171 REV. 3 03.01.01 Account Management

Requirement

1. Define the types of system accounts allowed and prohibited.
2. Create, enable, modify, disable, and remove system accounts in accordance with policy, procedures, prerequisites, and criteria.
3. Specify:
   1. Authorized users of the system,
   2. Group and role membership, and
   3. Access authorizations (i.e., privileges) for each account.
4. Authorize access to the system based on:
   1. A valid access authorization and
   2. Intended system usage.
5. Disable system accounts when:
   1. The accounts have expired,
   2. The accounts have been inactive for [Assignment: organization-defined time period],
   3. The accounts are no longer associated with a user or individual
   4. The accounts are in violation of organizational policy, or
   5. Significant risks associated with individuals are discovered.
6. Notify account managers and designated personnel or roles within:
   1. [Assignment: organization-defined time period] when accounts are no longer required.
   2. [Assignment: organization-defined time period] when users are terminated or transferred.
   3. [Assignment: organization-defined time period] when system usage or the need-to-know changes for an individual.
7. Require that users log out of the system after [Assignment: organization-defined time period] of expected inactivity or when [Assignment: organization-defined circumstances].

Explanation

This requirement focuses on account management for systems and applications. The definition and enforcement of access authorizations other than those determined by account type (e.g., privileged access, non-privileged access) are addressed in 03.01.02. System account types include individual, group, temporary, system, guest, anonymous, emergency, developer, and service. Users who require administrative privileges on system accounts receive additional scrutiny by personnel responsible for approving such accounts and privileged access. Types of accounts that organizations may prohibit due to increased risk include group, emergency, guest, anonymous, and temporary.

Organizations may choose to define access privileges or other attributes by account, type of account, or a combination of both. Other attributes required for authorizing access include restrictions on the time of day, day of the week, and point of origin. When defining other system account attributes, organizations consider system requirements (e.g., system upgrades, scheduled maintenance) and mission and business requirements (e.g., time zone differences, remote access to facilitate travel requirements).