AC-02 Account Managementac-2
Whether an AWS call fetches evidence for this control, and what to run. Its Rev5 baselines, the indicators that reach it and the FedRAMP guidance attached to it open below.
Partial1 of 1 recipe reaches AC-02, and none is rated full — the output narrows the question, a human judgement closes it.
AWS IAM1 recipe · 2 calls
Collect evidence (1)
Authored AWS recipes whose output is evidence for AC-02. This mapping is this project’s opinion (overlay v3.0.0), versioned separately from the dataset — the upstream FedRAMP rules name none of these tools.
What NIST requires of AC-02
The control statement from NIST 800-53 Rev5, verbatim. Square brackets are organization-defined parameters — yours to set, not FedRAMP's to dictate.
a. Define and document the types of accounts allowed and specifically prohibited for use within the system; b. Assign account managers; c. Require [prerequisites and criteria] for group and role membership; d. Specify: 1. Authorized users of the system; 2. Group and role membership; and 3. Access authorizations (i.e., privileges) and [attributes (as required)] for each account; e. Require approvals by [personnel or roles] for requests to create accounts; f. Create, enable, modify, disable, and remove accounts in accordance with [policy, procedures, prerequisites, and criteria]; g. Monitor the use of accounts; h. Notify account managers and [personnel or roles] within: 1. [time period] when accounts are no longer required; 2. [time period] when users are terminated or transferred; and 3. [time period] when system usage or need-to-know changes for an individual; i. Authorize access to the system based on: 1. A valid access authorization; 2. Intended system usage; and 3. [attributes (as required)]; j. Review accounts for compliance with account management requirements [frequency]; k. Establish and implement a process for changing shared or group account authenticators (if deployed) when individuals are removed from the group; and l. Align account management processes with personnel termination and transfer processes.
NIST SP 800-53 Rev5 catalog 5.2.0, from usnistgov/oscal-content at 78650f0. The FedRAMP dataset carries no control text; this is borrowed and pinned.
Rev5 baseline membership
Membership is the whole relationship — a baseline is a set of control ids. Class A carries no baseline at all. The Low/Moderate/High labels are an interpretation from control counts, not a dataset fact.
KSI indicators reaching this control (4)
Under 20x, these indicators are how this control is demonstrated — automated KSI evidence stands in for narrative control evidence.
- IAMKSI-IAM-APMAdopting Passwordless Methods
Secure passwordless methods are used for user authentication and authorization when feasible, otherwise strong passwords with phishing-resistant MFA is used.
- IAMKSI-IAM-JITAuthorizing Just-in-Time
A least-privileged, role and attribute-based, and just-in-time security authorization model is used and persistently reviewed for all user and non-user accounts and services.
- IAMKSI-IAM-SNUSecuring Non-User Authentication
Appropriately secure authentication methods are used and persistently reviewed for non-user accounts and services.
- IAMKSI-IAM-SUSResponding to Suspicious Activity
Accounts with privileged access are disabled or otherwise secured in response to suspicious activity.
Pages exist for the 209 controls reached by at least one KSI. Baseline-only controls are the orphans on /coverage. Control titles and full text live in the NIST catalog, not this dataset.