NIST 800-53 r5 · Controls catalogue · Family AC

AC-2Account Management

Define and document the types of accounts allowed and specifically prohibited for use within the system; Assign account managers; Require {{ insert: param, ac-02_odp.01 }} for group and role membership; Specify: Authorized users of the system; Group and role membership; and Access authorizations (i.e., privileges) and {{ insert: param, ac-02_odp.02 }} for each account; Require approvals by {{ insert: param, ac-02_odp.03 }} for requests to create accounts; Create, enable, modify, disable, and remove accounts in accordance with {{ insert: param, ac-02_odp.04 }}; Monitor the use of accounts; Notify account managers and {{ insert: param, ac-02_odp.05 }} within: {{ insert: param, ac-02_odp.06 }} when accounts are no longer required; {{ insert: param, ac-02_odp.07 }} when users are terminated or transferred; and {{ insert: param, ac-02_odp.08 }} when system usage or need-to-know changes for an individual; Authorize access to the system based on: A valid access authorization; Intended system usage; and {{ insert: param, ac-02_odp.09 }}; Review accounts for compliance with account management requirements {{ insert: param, ac-02_odp.10 }}; Establish and implement a process for changing shared or group account authenticators (if deployed) when individuals are removed from the group; and Align account management processes with personnel termination and transfer processes.

Last updated: 22 August 2026 07:11 UTC

Implementations targeting this control (8)

aws-config-iam-policy-no-statements-with-admin-access No IAM policy grants full admin (*:*) AWS::IAM::Policy partial protect enforce
aws-config-iam-no-inline-policy-check IAM identities have no inline policies AWS::IAM::Role partial protect enforce
gcp-cis-iam-no-primitive-roles No primitive roles granted at the project level cloudresourcemanager.googleapis.com/Project partial protect enforce
aws-config-iam-customer-policy-blocked-kms-actions Iam Customer Policy Blocked Kms Actions AWS::IAM::Policy partial protect enforce
aws-config-iam-inline-policy-blocked-kms-actions Iam Inline Policy Blocked Kms Actions AWS::IAM::Policy partial protect enforce
aws-config-iam-policy-no-statements-with-full-access Iam Policy No Statements With Full Access AWS::IAM::Policy partial protect enforce
aws-config-iam-user-group-membership-check Iam User Group Membership Check AWS::IAM::User partial protect enforce
aws-config-iam-user-unused-credentials-check Iam User Unused Credentials Check AWS::IAM::User partial protect enforce CIS v5 §1.11CIS v3 §1.12Hub IAM.22

ATT&CK techniques this control mitigates (218)

T1003 OS Credential Dumping Credential Access
T1003.001 LSASS Memory Credential Access
T1003.002 Security Account Manager Credential Access
T1003.003 NTDS Credential Access
T1003.004 LSA Secrets Credential Access
T1003.005 Cached Domain Credentials Credential Access
T1003.006 DCSync Credential Access
T1003.007 Proc Filesystem Credential Access
T1003.008 /etc/passwd and /etc/shadow Credential Access
T1005 Data from Local System Collection
T1020.001 Traffic Duplication Exfiltration
T1021 Remote Services Lateral Movement
T1021.001 Remote Desktop Protocol Lateral Movement
T1021.002 SMB/Windows Admin Shares Lateral Movement
T1021.003 Distributed Component Object Model Lateral Movement
T1021.004 SSH Lateral Movement
T1021.005 VNC Lateral Movement
T1021.006 Windows Remote Management Lateral Movement
T1021.007 Cloud Services Lateral Movement
T1021.008 Direct Cloud VM Connections Lateral Movement
T1025 Data from Removable Media Collection
T1036 Masquerading Stealth
T1036.003 Rename Legitimate Utilities Stealth
T1036.005 Match Legitimate Resource Name or Location Stealth
T1036.010 Masquerade Account Name Stealth
T1041 Exfiltration Over C2 Channel Exfiltration
T1047 Windows Management Instrumentation Execution
T1048 Exfiltration Over Alternative Protocol Exfiltration
T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol Exfiltration
T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol Exfiltration
T1052 Exfiltration Over Physical Medium Exfiltration
T1052.001 Exfiltration over USB Exfiltration
T1053 Scheduled Task/Job Execution, Persistence, Privilege Escalation
T1053.002 At Execution, Persistence, Privilege Escalation
T1053.003 Cron Execution, Persistence, Privilege Escalation
T1053.005 Scheduled Task Execution, Persistence, Privilege Escalation
T1053.006 Systemd Timers Execution, Persistence, Privilege Escalation
T1053.007 Container Orchestration Job Execution, Persistence, Privilege Escalation
T1055 Process Injection Stealth, Privilege Escalation
T1055.008 Ptrace System Calls Stealth, Privilege Escalation
T1056.003 Web Portal Capture Collection, Credential Access
T1059 Command and Scripting Interpreter Execution
T1059.001 PowerShell Execution
T1059.002 AppleScript Execution
T1059.003 Windows Command Shell Execution
T1059.004 Unix Shell Execution
T1059.005 Visual Basic Execution
T1059.006 Python Execution
T1059.007 JavaScript Execution
T1059.008 Network Device CLI Execution

Weaknesses this control addresses (8)AI-assisted

CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.

CWE	Name	CVEs	Why this control addresses it
`CWE-862`	Missing Authorization	10,200+	Requiring approvals for account creation and specifying authorizations ensures authorization is not missing for system access.
`CWE-284`	Improper Access Control	6,900+	Defining account types, requiring approvals for creation, specifying authorizations, monitoring usage, and reviewing accounts directly prevents improper access control by ensuring only authorized accounts exist and are used.
`CWE-863`	Incorrect Authorization	3,900+	Monitoring account use, notifying on changes, and reviewing accounts for compliance corrects incorrect authorization assignments.
`CWE-269`	Improper Privilege Management	3,400+	Assigning group/role memberships and access authorizations (privileges) while reviewing accounts addresses improper privilege management.
`CWE-285`	Improper Authorization	1,500+	Specifying access authorizations for each account and requiring approvals for account requests enforces proper authorization decisions.
`CWE-266`	Incorrect Privilege Assignment	1,000+	Explicitly specifying privileges and group/role memberships for accounts reduces the risk of incorrect privilege assignments.
`CWE-250`	Execution with Unnecessary Privileges	300+	Reviewing accounts for compliance, disabling/removing unneeded accounts, and aligning with termination processes prevents execution with unnecessary privileges.
`CWE-272`	Least Privilege Violation	38	Requiring specification of intended system usage and access authorizations, plus periodic reviews, supports enforcement of least privilege.

Top CVEs where this control is the strongest mitigation

CVE	Risk	CVSS	EPSS	Match
`CVE-2024-21888`	9.1	8.8	0.8681	good
`CVE-2024-49035` KEV	8.9	8.7	0.0134	good
`CVE-2025-20282`	8.8	10.0	0.2652	good
`CVE-2024-8068` KEV	8.7	8.0	0.0139	good
`CVE-2025-6934`	8.7	9.8	0.2505	good
`CVE-2026-1492`	8.7	9.8	0.2423	good
`CVE-2024-26169` KEV	8.5	7.8	0.0401	good
`CVE-2024-38014` KEV	8.5	7.8	0.0626	good
`CVE-2026-21533` KEV	8.5	7.8	0.0385	good
`CVE-2023-38944`	8.4	9.8	0.1553	good
`CVE-2024-24747`	8.2	8.8	0.3409	good
`CVE-2025-8489`	8.2	9.8	0.0927	good
`CVE-2024-24402`	7.8	9.8	0.0340	good
`CVE-2023-26009`	7.8	9.8	0.0273	good
`CVE-2023-26540`	7.8	9.8	0.0273	good
`CVE-2023-37999`	7.8	9.8	0.0335	good
`CVE-2024-6624`	7.8	9.8	0.0287	good
`CVE-2025-4334`	7.7	9.8	0.0205	good
`CVE-2023-49232`	7.6	9.8	0.0152	good
`CVE-2024-33775`	7.6	9.8	0.0160	good
`CVE-2024-12284`	7.6	8.8	0.1330	good
`CVE-2023-48902`	7.5	9.8	0.0128	good
`CVE-2024-34331`	7.5	9.8	0.0100	good
`CVE-2025-14533`	7.5	9.8	0.0100	good
`CVE-2026-0920`	7.5	9.8	0.0110	good

Other controls in family AC

AC-1 AC-10 AC-11 AC-12 AC-13 AC-14 AC-15 AC-16 AC-17 AC-18 AC-19 AC-20 AC-21 AC-22 AC-23 AC-24 AC-25 AC-3 AC-4 AC-5 AC-6 AC-7 AC-8 AC-9