CCI-001682

Automatically removes or disables emergency accounts after an organization-defined time period for each type of account.

9 rules found Severity: Medium

20 rules found Severity: Medium

3 rules found Severity: Medium

1 rule found Severity: Medium

1 rule found Severity: High

1 rule found Severity: Medium

1 rule found Severity: Low

2 rules found Severity: Medium

2 rules found Severity: Low

1 rule found Severity: Medium

1 rule found Severity: Low

2 rules found Severity: Medium

1 rule found Severity: Medium

2 rules found Severity: Medium

1 rule found Severity: Medium

2 rules found Severity: Low

3 rules found Severity: Medium

CCI-001682

Assign Expiration Date to Emergency Accounts

Assign Expiration Date to Temporary Accounts

Never Automatically Remove or Disable Emergency Administrator Accounts

Compliance Guardian must provide automated mechanisms for supporting account management functions.

The CA API Gateway must automatically remove or disable emergency accounts, except the emergency administration account, after 72 hours.

The storage system must be configured to have only 1 emergency account which can be accessed without LDAP, and which has full administrator capabilities.

IBM z/VM must remove or disable emergency accounts after the crisis is resolved or 72 hours.

Nutanix AOS must automatically remove or disable temporary user accounts after 72 hours.

The macOS system must automatically remove or disable temporary and emergency user accounts after 72 hours.

The Ubuntu operating system must automatically expire temporary accounts within 72 hours.

The Red Hat Enterprise Linux operating system must automatically expire temporary accounts within 72 hours.

The BIG-IP appliance must be configured to automatically remove or disable emergency accounts after 72 hours.

The HPE 3PAR OS must be configured to have only one emergency account that can be accessed without LDAP and that has full administrator privileges.

The AIX system must automatically remove or disable emergency accounts after the crisis is resolved or 72 hours.

Windows Server 2016 must automatically remove or disable emergency accounts after the crisis is resolved or within 72 hours.

The Oracle Linux operating system must automatically expire temporary accounts within 72 hours.

Rancher MCM must never automatically remove or disable emergency accounts.

SLEM 5 must automatically expire temporary accounts within 72 hours.

SLEM 5 must never automatically remove or disable emergency administrator accounts.

TOSS must automatically remove or disable emergency accounts after the crisis is resolved or 72 hours.

NixOS emergency or temporary user accounts must be provisioned with an expiration time of 72 hours or less.

AAA Services must be configured to prevent automatically removing emergency accounts.

AAA Services must be configured to prevent automatically disabling emergency accounts.

The macOS system must automatically remove or disable temporary or emergency user accounts within 72 hours.

Ubuntu 22.04 LTS must automatically expire temporary accounts within 72 hours.

AlmaLinux OS 9 must automatically expire temporary accounts within 72 hours.

The container platform must never automatically remove or disable emergency accounts.

The Dragos Platform must only allow local administrative and service user accounts.

The information system must automatically remove or disable emergency accounts after the crisis is resolved or 72 hours.

IBM RACF emergency USERIDs must be properly defined.

IBM z/OS system administrator must develop a procedure to automatically remove or disable emergency accounts after the crisis is resolved or 72 hours.

The IBM z/OS system administrator (SA) must develop a process to disable emergency accounts after the crisis is resolved or 72 hours.

IBM z/OS system administrator (SA) must develop a procedure to remove or disable emergency accounts after the crisis is resolved or 72 hours.

The Mainframe Product must be configured such that emergency accounts are never automatically removed or disabled.

Windows Server 2019 must automatically remove or disable emergency accounts after the crisis is resolved or within 72 hours.

Windows Server 2022 must automatically remove or disable emergency accounts after the crisis is resolved or within 72 hours.

OL 8 must automatically expire temporary accounts within 72 hours.

RHEL 8 must automatically expire temporary accounts within 72 hours.

RHEL 9 must automatically expire temporary accounts within 72 hours.

The SUSE operating system must never automatically remove or disable emergency administrator accounts.

The SUSE operating system must automatically expire temporary accounts within 72 hours.

The VMM must automatically remove or disable emergency accounts after the crisis is resolved or 72 hours.

Access to the ESXi host must be limited by enabling lockdown mode.

The ESXi host must uniquely identify and must authenticate organizational users by using Active Directory.

The vCenter Server must uniquely identify and authenticate users or processes acting on behalf of users.