5.8.2.2
Implement Access Control and Authorization
Removal of Functions When No longer Required
Implement Access Control and Authorization – Removal of Functions When No longer Required – The organization shall remove accounts and/or functionality when users no longer require these for their tasks.
-
5.18 Access Rights: Provision, review, modify, and remove access rights to the information and other related assets according to organization’s access control policy and rules.
6.5 Responsibilities After Termination or Change of Employment: Define, enforce, and communicate information security responsibilities and duties that persist after termination or change of employment to relevant personnel and interested parties.
8.3 Information Access Restriction: Limit access to information and associated assets according to the established topic-specific access control policy.
-
3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).
3.1.2 Limit system access to the types
of transactions and functions that
authorized users are permitted to
execute.3.1.3 Control the flow of CUI in accordance with approved authorizations.
3.1.5 Employ the principle of least privilege, including for specific security functions and privileged accounts.
3.1.6 Use non-privileged accounts or roles when accessing nonsecurity functions.
3.1.7 Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.
3.1.12 Monitor and control remote access sessions.
3.4.5 Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems.
3.8.2 Limit access to CUI on system media to authorized users.
3.9.1 Screen individuals prior to authorizing access to organizational systems containing CUI.
-
3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).
3.1.2 Limit system access to the types
of transactions and functions that
authorized users are permitted to
execute.3.1.3 Control the flow of CUI in accordance with approved authorizations.
3.1.5 Employ the principle of least privilege, including for specific security functions and privileged accounts.
3.1.6 Use non-privileged accounts or roles when accessing nonsecurity functions.
3.1.7 Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.
3.1.12 Monitor and control remote access sessions.
3.4.5 Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems.
3.8.2 Limit access to CUI on system media to authorized users.
3.9.1 Screen individuals prior to authorizing access to organizational systems containing CUI.