Requirement
Prior to issuing system credentials and granting system access, the entity registers and authorizes new internal and external users whose access is administered by the entity. For those users whose access is administered by the entity, user system credentials are removed when user access is no longer authorized.
Points of Focus
Creates Access Credentials to Protected Information Assets
Requirement: The entity creates credentials for accessing protected information assets based on an authorization from the system's asset owner or authorized custodian. Authorization is required for the creation of all types of credentials of individuals (for example, employees, contractors, vendors, and business partner personnel), systems, and software.
Reviews Validity of Access Credentials
Requirement: The entity reviews access credentials on a periodic basis for validity (for example, employees, contractors, vendors, and business partner personnel) and inappropriate system or service accounts.
Prevents the Use of Credentials When No Longer Valid
Requirement: Processes are in place to disable, destroy, or otherwise prevent the use of access credentials when no longer valid.
Explanation
Every account must trace back to an explicit authorization, and must be disabled as soon as the person or system no longer needs it. Auditors test the full credential lifecycle: how access is requested and approved, how accounts are reviewed for validity, and how quickly credentials are revoked on departure or role change.
