---

id: "AC-02(04)" title: "Automated Audit Actions" family: "AC" family_name: "Access Control" sort_id: "ac-02.04" priority: "P1" implementation_level: "system" parent: "AC-02" enhancement: True

---

Statement

Automatically audit account creation, modification, enabling, disabling, and removal actions.

Guidance

Account management audit records are defined in accordance with AU-02 and reviewed, analyzed, and reported in accordance with AU-06.

Assessment Objective: account creation is automatically audited;

Assessment Objective: account modification is automatically audited;

Assessment Objective: account enabling is automatically audited;

Assessment Objective: account disabling is automatically audited;

Assessment Objective: account removal actions are automatically audited.

Access control policy

procedures addressing account management

system design documentation

system configuration settings and associated documentation

notifications/alerts of account creation, modification, enabling, disabling, and removal actions

system audit records

system security plan

other relevant documents or records

Organizational personnel with account management responsibilities

system/network administrators

organizational personnel with information security responsibilities

Automated mechanisms implementing account management functions