AC-2 (2) Control Enhancement (M) The information system automatically [Selection: removes; disables] temporary and emergency accounts after [FedRAMP Assignment: no more than 30 days for temporary and emergency account types]. AC-2 (2) Control Summary Information Responsible Role: Parameter AC-2(2)1: Parameter AC-2(2)2: Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , AC-2 (2) What is the solution and how is it implemented? AC-2 (3) Control Enhancement (M) The information system automatically disables inactive accounts after [FedRAMP Assignment: ninety (90) days for user accounts]. AC-2 (3) Additional FedRAMP Requirements and Guidance: Requirement: The service provider defines the time period for non-user accounts (e.g., accounts associated with devices). The time periods are approved and accepted by the Joint Authorization Board (JAB)/AO. Where user management is a function of the service, reports of activity of consumer users shall be made available. AC-2 (4) Control Enhancement (M) The information system automatically audits account creation, modification, enabling, disabling, and removal actions, and notifies [Assignment: organization-defined personnel or roles].
AC-2 (2) Control Enhancement (M) The information system automatically [Selection: removes; disables] temporary and emergency accounts after [FedRAMP Assignment: no more than 30 days for temporary and emergency account types]. AC-2 (2) Control Summary Information Responsible Role: Parameter AC-2(2)1: Parameter AC-2(2)2: Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , AC-2 (2) What is the solution and how is it implemented? AC-2 (3) Control Enhancement (M) The information system automatically disables inactive accounts after [FedRAMP Assignment: ninety (90) days for user accounts]. AC-2 (3) Additional FedRAMP Requirements and Guidance: Requirement: The service provider defines the time period for non-user accounts (e.g., accounts associated with devices). The time periods are approved and accepted by the Joint Authorization Board (JAB)/AO. Where user management is a function of the service, reports of activity of consumer users shall be made available. AC-2 (4) Control Enhancement (M) The information system automatically audits account creation, modification, enabling, disabling, and removal actions, and notifies [Assignment: organization-defined personnel or roles].