---

id: "AC-02(08)" title: "Dynamic Account Management" family: "AC" family_name: "Access Control" sort_id: "ac-02.08" priority: "P1" implementation_level: "system" parent: "AC-02" enhancement: True

---

Statement

Create, activate, manage, and deactivate {{ insert: param, ac-02.08_odp }} dynamically.

Guidance

Approaches for dynamically creating, activating, managing, and deactivating system accounts rely on automatically provisioning the accounts at runtime for entities that were previously unknown. Organizations plan for the dynamic management, creation, activation, and deactivation of system accounts by establishing trust relationships, business rules, and mechanisms with appropriate authorities to validate related authorizations and privileges.

Assessment Objective: {{ insert: param, ac-02.08_odp }} are created dynamically;

Assessment Objective: {{ insert: param, ac-02.08_odp }} are activated dynamically;

Assessment Objective: {{ insert: param, ac-02.08_odp }} are managed dynamically;

Assessment Objective: {{ insert: param, ac-02.08_odp }} are deactivated dynamically.

Access control policy

procedures addressing account management

system design documentation

system configuration settings and associated documentation

system-generated list of system accounts

system audit records

system security plan

other relevant documents or records

Organizational personnel with account management responsibilities

system/network administrators

organizational personnel with information security responsibilities

system developers

Automated mechanisms implementing account management functions