Account Management AC-2

Source: NIST SP 800-53 Rev.5, Access Control family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

AC-2 (Account Management) is about running the lifecycle of user accounts on purpose: who has an account, why, who approved it, and what happens to it when they leave or stop using it. It is a foundational Access Control that carries from the Low baseline up into Moderate.

What good looks like

• Use named accounts tied to a real person — no shared logins — and define the account types that exist.
• Approve an account before it is created, and grant only the access the role needs.
• Monitor account usage and audit account changes (create, modify, disable, remove).
• Disable or remove accounts when they are no longer needed, or when a person leaves or transfers.
• Review the account list on a schedule to catch drift. At Moderate, also disable accounts after a period of inactivity (enhancement AC-2(3)).

Framework mapping

• NIST CSF 2.0 — PR.AA-01 — Identities and credentials for authorized users are managed
• CIS Controls v8 — Control 5 — Account Management

How to move it toward Implemented

• Write a one-page account procedure: account types, who approves, and a review cadence (for example, monthly).
• Turn on inactivity disabling (set INACTIVE= in /etc/default/useradd or use chage --inactive) — this closes AC-2(3).
• Run and log a monthly account review (getent passwd, the sudoers list, and lastlog last-login times), saved as a dated file.
• Attach that review as hardening evidence on the asset, naming AC-2 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.