[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fac-2":3},{"item":4,"lessons":18,"controls":69,"related":100},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","ac-2","AC-2","Account Management",1394,"US National Institute of Standards and Technology (NIST)","**What it asks for.** The control asks you to manage the whole life of system accounts: define which account types are allowed, assign account managers, set criteria for group and role membership, approve and document who gets what, and create, change, disable and remove accounts according to policy, with regular reviews.\n\n**In practice.** This means a joiner, mover and leaver process driven from HR data, ideally automated through an identity platform, with named owners for privileged, service and shared accounts. Auditors look for approval records, periodic access review evidence with sign-off, timely disabling of leavers and reports of inactive accounts. CIS Control 5 and ISO\u002FIEC 27001 user access management controls cover the same ground.\n\n**Common gaps.** Service and shared accounts without owners, access reviews that are rubber-stamped, and movers who keep old access are the most common findings. Accounts in cloud and SaaS tools outside the central directory are often missed entirely.","a. Define and document the types of accounts allowed and specifically prohibited for use within the system;\n  b. Assign account managers;\n  c. Require [Assignment: organization-defined prerequisites and criteria] for group and role membership;\n  d. Specify:\n    1. Authorized users of the system;\n    2. Group and role membership; and\n    3. Access authorizations (i.e., privileges) and [Assignment: organization-defined attributes (as required)] for each account;\n  e. Require approvals by [Assignment: organization-defined personnel or roles] for requests to create accounts;\n  f. Create, enable, modify, disable, and remove accounts in accordance with [Assignment: organization-defined policy, procedures, prerequisites, and criteria];\n  g. Monitor the use of accounts;\n  h. Notify account managers and [Assignment: organization-defined personnel or roles] within:\n    1. [Assignment: organization-defined time period] when accounts are no longer required;\n    2. [Assignment: organization-defined time period] when users are terminated or transferred; and\n    3. [Assignment: organization-defined time period] when system usage or need-to-know changes for an individual;\n  i. Authorize access to the system based on:\n    1. A valid access authorization;\n    2. Intended system usage; and\n    3. [Assignment: organization-defined attributes (as required)];\n  j. Review accounts for compliance with account management requirements [Assignment: organization-defined frequency];\n  k. Establish and implement a process for changing shared or group account authenticators (if deployed) when individuals are removed from the group; and\n  l. Align account management processes with personnel termination and transfer processes.\nDiscussion: Examples of system account types include individual, shared, group, system, guest, anonymous, emergency, developer, temporary, and service. Identification of authorized system users and the specification of access privileges reflect the requirements in other controls in the security plan. Users requiring administrative privileges on system accounts receive additional scrutiny by organizational personnel responsible for approving such accounts and privileged access, including system owner, mission or business owner, senior agency information security officer, or senior agency official for privacy. Types of accounts that organizations may wish to prohibit due to increased risk include shared, group, emergency, anonymous, temporary, and guest accounts.\n\nWhere access involves personally identifiable information, security programs collaborate with the senior agency official for privacy to establish the specific conditions for group and role membership; specify authorized users, group and role membership, and access authorizations for each account; and create, adjust, or remove system accounts in accordance with organizational policies. Policies can include such information as account expiration dates or other factors that trigger the disabling of accounts. Organizations may choose to define access privileges or other attributes by account, type of account, or a combination of the two. Examples of other attributes required for authorizing access include restrictions on time of day, day of week, and point of origin. In defining other system account attributes, organizations consider system-related requirements and mission\u002Fbusiness requirements. Failure to consider these factors could affect system availability.\n\nTemporary and emergency accounts are intended for short-term use. Organizations establish temporary accounts as part of normal account activation procedures when there is a need for short-term accounts without the demand for immediacy in account activation. Organizations establish emergency accounts in response to crisis situations and with the need for rapid account activation. Therefore, emergency account activation may bypass normal account authorization processes. Emergency and temporary accounts are not to be confused with infrequently used accounts, including local logon accounts used for special tasks or when network resources are unavailable (may also be known as accounts of last resort). Such accounts remain available and are not subject to automatic disabling or removal dates. Conditions for disabling or deactivating accounts include when shared\u002Fgroup, emergency, or temporary accounts are no longer required and when individuals are transferred or terminated. Changing shared\u002Fgroup authenticators when members leave the group is intended to ensure that former group members do not retain access to the shared or group account. Some types of system accounts may require specialized training.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":19,"list":20},1393,[21,25,29,33,37,41,45,49,53,57,61,65],{"slug":22,"title":23,"published_at":24},"connectwise-cloud-backup-suspended-after-microsoft-365-tenant-compromise","ConnectWise Cloud Backup Suspended After Microsoft 365 Tenant Compromise","2026-10-18T10:20:20.475+00:00",{"slug":26,"title":27,"published_at":28},"connectwise-supply-chain-attack-compromises-162-microsoft-365-tenants","ConnectWise Supply-Chain Attack Compromises 162 Microsoft 365 Tenants","2026-10-17T16:20:21.545+00:00",{"slug":30,"title":31,"published_at":32},"compromised-connectwise-credential-exposes-173-microsoft-365-tenants","Compromised ConnectWise Credential Exposes 173 Microsoft 365 Tenants","2026-10-17T08:20:20.122+00:00",{"slug":34,"title":35,"published_at":36},"cross-jurisdictional-law-enforcement-surveillance-of-political-activists-raises-civil-liberties-alar","Cross-Jurisdictional Law Enforcement Surveillance of Political Activists Raises Civil Liberties Alarms","2026-10-16T20:20:31.596+00:00",{"slug":38,"title":39,"published_at":40},"shadow-ai-personal-chatgpt-use-at-work-creates-data-exposure-risk","Shadow AI: Personal ChatGPT Use at Work Creates Data Exposure Risk","2026-10-16T16:21:15.148+00:00",{"slug":42,"title":43,"published_at":44},"ai-model-misappropriates-third-party-crypto-funds-to-complete-task","AI Model Misappropriates Third-Party Crypto Funds to Complete Task","2026-10-16T16:20:58.749+00:00",{"slug":46,"title":47,"published_at":48},"spanish-cycling-federation-fined-4800-after-two-month-data-breach-exposing-261965-records","Spanish Cycling Federation Fined €4,800 After Two-Month Data Breach Exposing 261,965 Records","2026-10-16T16:20:43.825+00:00",{"slug":50,"title":51,"published_at":52},"bae-systems-breach-cripples-us-bankruptcy-court-noticing-system","BAE Systems Breach Cripples US Bankruptcy Court Noticing System","2026-10-16T16:20:16.497+00:00",{"slug":54,"title":55,"published_at":56},"ai-models-act-autonomously-to-bypass-auth-and-raid-crypto-wallets","AI Models Act Autonomously to Bypass Auth and Raid Crypto Wallets","2026-10-16T12:21:09.736+00:00",{"slug":58,"title":59,"published_at":60},"ai-agents-accessed-live-sensitive-data-during-testing-due-to-exposed-credentials-and-excessive-permi","AI Agents Accessed Live Sensitive Data During Testing Due to Exposed Credentials and Excessive Permissions","2026-10-16T08:20:59.754+00:00",{"slug":62,"title":63,"published_at":64},"billion-message-phishing-infrastructure-dismantled-by-microsoft-and-partners","Billion-Message Phishing Infrastructure Dismantled by Microsoft and Partners","2026-10-15T12:20:54.937+00:00",{"slug":66,"title":67,"published_at":68},"uk-legal-aid-agency-breach-exposes-decades-of-sensitive-records","UK Legal Aid Agency Breach Exposes Decades of Sensitive Records","2026-10-15T10:21:06.955+00:00",[70,75,80,85,90,95],{"slug":71,"name":72,"problem":73,"stories":74},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",518,{"slug":76,"name":77,"problem":78,"stories":79},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",297,{"slug":81,"name":82,"problem":83,"stories":84},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",289,{"slug":86,"name":87,"problem":88,"stories":89},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",237,{"slug":91,"name":92,"problem":93,"stories":94},"patch-management","Automated patch management","Known holes get closed in days, not months.",172,{"slug":96,"name":97,"problem":98,"stories":99},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",166,[101,107,113,117,122,127,132,137],{"family":102,"item":103,"code":104,"title":105,"together":106},"cis","6","Control 6","Access Control Management",953,{"family":108,"item":109,"code":110,"title":111,"together":112},"gdpr","32","Article 32","Security of processing",713,{"family":102,"item":114,"code":115,"title":8,"together":116},"5","Control 5",461,{"family":5,"item":118,"code":119,"title":120,"together":121},"ac-6","AC-6","Least Privilege",430,{"family":123,"item":124,"code":125,"title":125,"together":126},"itil","overview","ITIL",378,{"family":102,"item":128,"code":129,"title":130,"together":131},"3","Control 3","Data Protection",314,{"family":102,"item":133,"code":134,"title":135,"together":136},"8","Control 8","Audit Log Management",291,{"family":102,"item":138,"code":139,"title":140,"together":141},"14","Control 14","Security Awareness and Skills Training",273]