Field notebook · source record
AC-2(7)
Access ControlPrivileged User Accounts
The statement below is source material, not a generated control summary.
Source statement
Establish and administer privileged user accounts in accordance with {{ insert: param, ac-02.07_odp }}; Monitor privileged role or attribute assignments; Monitor changes to roles or attributes; and Revoke access when privileged role or attribute assignments are no longer appropriate.
Guidance
Privileged roles are organization-defined roles assigned to individuals that allow those individuals to perform certain security-relevant functions that ordinary users are not authorized to perform. Privileged roles include key management, account management, database administration, system and network administration, and web administration. A role-based access scheme organizes permitted system access and privileges into roles. In contrast, an attribute-based access scheme specifies allowed system access and privileges based on attributes.
Organization-defined parameters
Organization-defined · unresolvedCatalog reference only. No project value has been assigned or evaluated here.
- ac-02.07_odp
Organization-defined parameter
Allowed selection · one- a role-based access scheme
- an attribute-based access scheme
Assessment reference context
Retained, not activated.1 source assessment records and 4 objective nodes are available as reference context. This surface runs none of them.
ac-2.7_objAC-02(07)4 objective nodes
- privileged user accounts are established and administered in accordance with {{ insert: param, ac-02.07_odp }};
- privileged role or attribute assignments are monitored;
- changes to roles or attributes are monitored;
- access is revoked when privileged role or attribute assignments are no longer appropriate.
Reference method and authority
- InputExact release, source digest, control ID, and cited source fields
- Agent taskPrepare a bounded evidence request or test-plan draft
- Fail closedAbstain when source, scope, or assessment identity is missing
- Human acceptanceA named reviewer decides whether evidence supports the conclusion