AC-2 is the control auditors ask about first, because accounts are where access starts. It covers the whole lifecycle: which account types you allow, who approves them, how they change, and how they end.
SP 800-53 binds US federal systems and reaches contractors through agreements. Most other companies use it as a reference, and the questions a SOC 2 or ISO 27001 auditor asks about user access look very similar. Mappings between frameworks vary by source, so check the one your auditor uses.
What the control asks
The statement is long, so here is the shape of it. You define and document the account types allowed and the ones prohibited. You assign account managers. You set conditions for group and role membership. For each account you specify the authorized user, the group and role membership, and the privileges and other attributes.
Then the lifecycle: approvals before creation, and creating, enabling, modifying, disabling and removing accounts by a defined process. You monitor use. You tell account managers within a set time when accounts are no longer required, when users leave or transfer, and when need to know changes. You authorize access based on a valid authorization, intended usage and other attributes. You review accounts on a schedule. You change shared or group authenticators when someone leaves the group. And you align all of this with personnel termination and transfer processes.
What it means in practice
The guidance lists account types: individual, shared, group, system, guest, anonymous, emergency, developer, temporary and service. It suggests you consider prohibiting the riskier ones, namely shared, group, emergency, anonymous, temporary and guest accounts. It also says people who need administrative privileges get extra scrutiny from whoever approves them.
Where personal data is involved, security teams work with the privacy official on who gets access.
The enhancements show how mature programs go further: AC-2.1 Automated System Account Management, AC-2.2 Automated Temporary and Emergency Account Management, AC-2.3 Disable Accounts, AC-2.4 Automated Audit Actions, AC-2.5 Inactivity Logout, AC-2.6 Dynamic Privilege Management, AC-2.7 Privileged User Accounts and AC-2.8 Dynamic Account Management. You do not need all of them. Pick the ones that match your risk, such as AC-2.3 for dormant accounts.
Evidence to collect
- The account type policy: what is allowed and what is banned.
- A current list of accounts per system with owner, role and privileges.
- Approval records for a sample of new accounts, including admin requests.
- Offboarding records showing accounts disabled within your stated window, matched to HR leaving dates.
- The last access review, with reviewer, date and any removals.
- A list of shared or service accounts with owners and rotation records.
- Logs showing account creation, change and removal events.
Auditors usually pick a sample of leavers and new starters, then trace each to the system. Have the trace ready.
Common gaps
- Leavers still active in a SaaS tool that is not connected to single sign on.
- Service accounts with no owner.
- Reviews done as a rubber stamp, approving everything in one click.
- Shared admin logins with a password nobody changed after a departure.
- Roles that grew over time and nobody trimmed.
How to implement it
Start with a source of truth for people, such as your HR system, and connect your identity provider to it. Route access requests through a ticket or workflow that records an approver. Use groups mapped to roles so reviews look at roles, not individual toggles.
Make offboarding automatic where you can, and add a weekly check for accounts with no recent sign in. For service accounts, keep a register with an owner and a rotation date. Schedule the review quarterly for privileged access and at least yearly for the rest, and keep the evidence from each.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which account types does the guidance suggest you consider prohibiting?
Shared, group, emergency, anonymous, temporary and guest accounts, because of the higher risk they carry.
What must you do for shared account credentials when someone leaves the group?
Establish and implement a process to change the shared or group authenticators.
Which enhancement covers disabling accounts?
AC-2.3 Disable Accounts.
Sources
- NIST SP 800-53 Rev 5, AC-2: https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_1_1/home?element=AC-2
- NIST OSCAL catalog of SP 800-53 Rev 5: https://raw.githubusercontent.com/usnistgov/oscal-content/main/nist.gov/SP800-53/rev5/json/NIST_SP-800-53_rev5_catalog.json
