OM-IND-0016: Account Ownership

OM-IND-0016

Account Ownership

RECOMMENDED

1.0

Provides actionable information to implement OM-BP-0001: Account Ownership.

Accountability over inactive users

The indicator expressly mentions active user IDs. It should be left at the discretion of the organization to determine whether accountability must be enforced over all or a subset of inactive user IDs as well.

For instance, some high privileged accounts may be purposefully deactivated to reduce the attack surface of systems and reactivated as part of break-the-glass procedures. Such inactive accounts typically require clear accountability.

Account sharing

Shared accounts is a well-known bad security practice that prevents traceability.

• Replaces OM-IND-0015: Active user IDs assigned to only one person