Skip to main content

IAC-08: Account Management

IAC 10 — Critical Protect

Mechanisms exist to: (1) Define authorized system account types; (2) Define prohibited system account types; and (3) Proactively govern individual, group, system, service, application, guest and temporary accounts.

Renumbered: Formerly IAC-15 in SCF 2025.4.

Code reused: In SCF 2025.4 and earlier, IAC-08 was Role-Based Access Control (RBAC). That control is now IAC-06.

Control Question: Does the organization: (1) Define authorized system account types; (2) Define prohibited system account types; and (3) Proactively govern individual, group, system, service, application, guest and temporary accounts?

General (39)
Framework Mapping Values
AICPA TSC 2017:2022 (used for SOC 2) (source) CC6.1
GovRAMP AC-02
GovRAMP Core AC-02
GovRAMP Low AC-02
GovRAMP Low+ AC-02
GovRAMP Moderate AC-02
GovRAMP High AC-02
IEC 62443-2-1 2024 USER 1.2 USER 1.3
IEC 62443-3-3 2013 SR 1.3
IMO Maritime Cyber Risk Management 3.5.3.1
ISO 27002 2022 5.15 5.16 5.18
ISO 27017 2015 9.1.1 9.2.5 9.2.6
ISO 27018 2025 5.15 5.16 5.18
MITRE ATT&CK 16 T1003 T1003.001 T1003.002 T1003.003 T1003.004 T1003.005 T1003.006 T1003.007 T1003.008 T1005 T1020.001 T1021 T1021.001 T1021.002 T1021.003 T1021.004 T1021.005 T1021.006 T1021.007 T1021.008 T1025 T1036 T1036.003 T1036.005 T1036.010 T1041 T1047 T1048 T1048.002 T1048.003 T1052 T1052.001 T1053 T1053.002 T1053.003 T1053.005 T1053.006 T1053.007 T1055 T1055.008 T1056.003 T1059 T1059.001 T1059.002 T1059.003 T1059.004 T1059.005 T1059.006 T1059.007 T1059.008 T1059.009 T1059.010 T1059.011 T1068 T1070 T1070.001 T1070.002 T1070.003 T1070.007 T1070.008 T1070.009 T1072 T1078 T1078.001 T1078.002 T1078.003 T1078.004 T1087 T1087.004 T1098 T1098.001 T1098.002 T1098.003 T1098.005 T1098.006 T1098.007 T1110 T1110.001 T1110.002 T1110.003 T1110.004 T1134 T1134.001 T1134.002 T1134.003 T1136 T1136.001 T1136.002 T1136.003 T1185 T1190 T1195 T1197 T1210 T1212 T1213 T1213.001 T1213.002 T1213.003 T1213.004 T1213.005 T1218 T1218.007 T1218.015 T1222 T1222.001 T1222.002 T1484 T1485.001 T1489 T1490 T1495 T1496.002 T1505 T1505.002 T1505.003 T1505.005 T1525 T1528 T1530 T1537 T1538 T1542 T1542.001 T1542.003 T1542.005 T1543 T1543.001 T1543.002 T1543.003 T1543.004 T1543.005 T1546 T1546.003 T1547.004 T1547.006 T1547.009 T1547.012 T1547.013 T1548 T1548.002 T1548.003 T1548.005 T1548.006 T1550 T1550.002 T1550.003 T1552 T1552.001 T1552.002 T1552.004 T1552.006 T1552.007 T1553 T1555.005 T1555.006 T1556 T1556.001 T1556.003 T1556.004 T1556.005 T1556.006 T1556.007 T1556.009 T1558 T1558.001 T1558.002 T1558.003 T1558.004 T1558.005 T1559 T1559.001 T1562 T1562.001 T1562.002 T1562.004 T1562.006 T1562.007 T1562.008 T1562.009 T1562.012 T1563 T1563.001 T1563.002 T1566.003 T1567 T1569 T1569.001 T1569.002 T1574 T1574.004 T1574.005 T1574.007 T1574.008 T1574.009 T1574.010 T1574.012 T1578 T1578.001 T1578.002 T1578.003 T1578.005 T1580 T1585 T1585.001 T1585.002 T1585.003 T1586 T1586.001 T1586.002 T1586.003 T1599 T1599.001 T1601 T1601.001 T1601.002 T1606 T1606.001 T1606.002 T1609 T1610 T1611 T1612 T1613 T1619 T1621 T1648 T1651 T1654
NIST 800-53 R4 AC-2
NIST 800-53 R5.2 AC-02
NIST 800-53B R5 (low) (source) AC-02
NIST 800-53B R5 (moderate) (source) AC-02
NIST 800-53B R5 (high) (source) AC-02
NIST SP 800-66 R2 164.312(a)
NIST 800-82 R3 AC-02
NIST 800-82 R3 LOW OT Overlay AC-02
NIST 800-82 R3 MODERATE OT Overlay AC-02
NIST 800-82 R3 HIGH OT Overlay AC-02
NIST 800-161 R1 AC-2
NIST 800-161 R1 C-SCRM Baseline AC-2
NIST 800-161 R1 Flow Down AC-2
NIST 800-161 R1 Level 2 AC-2
NIST 800-161 R1 Level 3 AC-2
NIST 800-171 R2 (source) 3.1.2
NIST 800-171 R3 (source) 03.01.01.a 03.01.01.b 03.01.01.c.01 03.01.01.c.02 03.01.01.d.01 03.01.01.d.02 03.01.01.e 03.01.01.f.01 03.01.01.f.02 03.01.01.f.03 03.01.01.f.04 03.01.01.f.05 03.01.01.g.01 03.01.01.g.02 03.01.01.g.03 03.01.02 03.01.05.b 03.01.05.c 03.01.05.d 03.05.07.e
NIST 800-171A (source) 3.1.2[a] 3.1.2[b]
NIST 800-171A R3 (source) A.03.01.01.ODP[01] A.03.01.01.a[01] A.03.01.01.a[02] A.03.01.01.b[01] A.03.01.01.b[02] A.03.01.01.b[03] A.03.01.01.c.01 A.03.01.01.c.02 A.03.01.01.d.01 A.03.01.01.d.02 A.03.01.01.e A.03.01.01.f.01 A.03.01.01.f.02 A.03.01.01.f.03 A.03.01.01.f.04 A.03.01.01.f.05 A.03.01.01.g.01 A.03.01.01.g.02 A.03.01.01.g.03 A.03.01.02[01] A.03.01.02[02] A.03.01.05.b[01] A.03.01.05.b[02] A.03.01.05.c A.03.01.05.d A.03.05.07.e
PCI DSS 4.0.1 (source) 8.2.4 8.3.10 8.6 8.6.1
PCI DSS 4.0.1 SAQ A-EP (source) 8.2.4 8.6.1
PCI DSS 4.0.1 SAQ C (source) 8.2.4 8.6.1
PCI DSS 4.0.1 SAQ C-VT (source) 8.2.4
PCI DSS 4.0.1 SAQ D Merchant (source) 8.2.4 8.6.1
PCI DSS 4.0.1 SAQ D Service Provider (source) 8.2.4 8.3.10 8.6.1
US (20)
Framework Mapping Values
USA Federal CMS MARS-E 2.0 AC-2 AC-2.a AC-2.b AC-2.c AC-2.d AC-2.e AC-2.f AC-2.f.1 AC-2.f.1(i) AC-2.f.1(ii) AC-2.f.1(iii) AC-2.f.2 AC-2.f.3 AC-2.f.3(i) AC-2.f.3(ii) AC-2.f.3(iii) AC-2.g AC-2-IS.1 AC-2-IS.2 AC-2-IS.4
USA Federal C2M2 2.1 ACCESS-2b
USA Federal CMMC 2.0 Level 1 AC.L1-B.1.II
USA Federal CMMC 2.0 Level 1 AOs AC.L1-B.1.II[a] AC.L1-B.1.II[b]
USA Federal CMMC 2.0 Level 2 ACL2.-3.1.2
USA Federal FAR 52.204-21 52.204-21(b)(1)(ii)
USA Federal CJIS Security Policy 6.0 AC-2
USA Federal FedRAMP R5 (low) AC-02
USA Federal FedRAMP R5 (moderate) AC-02
USA Federal FedRAMP R5 (high) AC-02
USA Federal FedRAMP R5 (LI-SaaS) AC-02
USA Federal IRS 1075 2021 AC-2
USA Federal HIPAA Security Rule NIST SP 800-66 R2 § 164.312(a)(2)(ii)
USA Federal HIPAA Administrative Simplification 2013 § 164.312(a)(2)(ii)
USA Federal NERC CIP 2024 CIP-007-6 5.3
USA Massachusetts 201 CMR 17.00 2008 17.04(1)(a) 17.04(1)(d) 17.04(2)(b)
USA Texas DIR SCSC 2.2 2025 AC-02 IA-02-SID IA-08-SID
USA Texas TX-RAMP Level 1 AC-02
USA Texas TX-RAMP Level 2 AC-02
USA Vermont Act 171 2018 2447(c)(1)(A)(i) 2447(c)(1)(A)(iv)
EMEA (12)
Framework Mapping Values
EMEA Germany C5 2026 IAM-01.01B.2 IAM-01.02B.5 IAM-01.02B.8 IAM-01.02B.11 IAM-01.02B.15 IAM-02.01B IAM-02.02B IAM-02.02B.2 IAM-02.03B IAM-03.01B IAM-03.04B IAM-04.04B IAM-04.05B IAM-07.03AC.2
EMEA Spain CCN-STIC 825 op.acc.1 op.acc.2 op.acc.4 op.acc.5
EMEA EU DORA RTS 2024 Article 20.2(c) Article 21.1(e) Article 33.1(c)
EMEA EU EBA GL/2019/04 3.4.2.31(c)
EMEA EU NIS2 Annex 2024 11.2.2(c) 11.5.2(c)
EMEA UK Cyber Essentials 3.3 2-BP1 4-BP1 4-BP3
EMEA UK DEFSTAN 05-138 2024 2424
EMEA UK DEFSTAN 05-138 - L2 2024 2424
EMEA UK DEFSTAN 05-138 - L3 2024 2424
EMEA Israel CDMO 2.0 Appendix A, 8.1
EMEA Saudi Arabia CSCC-1 2019 2-2-1-7
EMEA Saudi Arabia SACS-002 2022 VII.B.TPC-32
APAC (10)
Framework Mapping Values
APAC Australia IoT Code of Practice 2024 1.0
APAC Australia ISM June 2026 ISM-0441 ISM-0443 ISM-1832 ISM-1834 ISM-1845 ISM-1940 ISM-1941 ISM-1942
APAC India SEBI CSCRF 2024 PR.AA.S1
APAC Japan ISMAP 9.2 9.2.1 9.2.1.1 9.2.1.2 9.2.1.3 9.2.1.4 9.2.1.5 9.2.1.6.PB 9.2.4.9.PB
APAC Malaysia RMiT 2025 10.56 12.8(c)
APAC New Zealand HISF MLHSP 2023 HHSP38 HML38
APAC New Zealand HISF Suppliers 2023 HSUP33 HSUP35
APAC Singapore CCOP CII 2026 5.2.1 5.2.2 12.2.3
APAC Singapore Cyber Hygiene Practice 2019 4.1
APAC Singapore MAS TRM 2021 9.1.8
Americas (2)
Framework Mapping Values
Americas Bermuda BMACCC 2020 6.6
Americas Canada ITSP-10-171 2025 03.01.01.A 03.01.01.B 03.01.01.C.01 03.01.01.C.02 03.01.01.D.01 03.01.01.D.02 03.01.01.E 03.01.01.F.01 03.01.01.F.02 03.01.01.F.03 03.01.01.F.04 03.01.01.F.05 03.01.01.G.01 03.01.01.G.02 03.01.01.G.03 03.01.02 03.01.05.B 03.01.05.C 03.01.05.D 03.05.07.E

Capability Maturity Model

Level 0 — Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 — Performed Informally

SCR-CMM Level 1 criteria definitions are not available for this control: ▪ A reasonable person would conclude this control requires a structured process. ▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 — Planned & Tracked

Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines) to enforce Logical Access Control (LAC). ▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts. ▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services. ▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS.

Level 3 — Well Defined

Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners. ▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ An implemented and operational capability exists to: (1) Define authorized system account types; (2) Define prohibited system account types; and (3) Proactively govern individual, group, system, service, application, guest and temporary accounts.

Level 4 — Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 — Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Assessment Objectives

  1. IAC-08_A01 criteria for account creation, enabling, modification, disabling and removal are defined.
  2. IAC-08_A02 approvals are required by organization-defined personnel or roles for requests to create accounts.
  3. IAC-08_A03 accounts are created in accordance with organization-defined policy, procedures, prerequisites and criteria.
  4. IAC-08_A04 accounts are enabled in accordance with organization-defined policy, procedures, prerequisites and criteria.
  5. IAC-08_A05 accounts are modified in accordance with organization-defined policy, procedures, prerequisites and criteria.
  6. IAC-08_A06 accounts are disabled in accordance with organization-defined policy, procedures, prerequisites and criteria.
  7. IAC-08_A07 accounts are removed in accordance with organization-defined policy, procedures, prerequisites and criteria.
  8. IAC-08_A08 the use of accounts is monitored.
  9. IAC-08_A09 accounts are reviewed for compliance with account management requirements organization-defined frequency.
  10. IAC-08_A10 account management processes are aligned with personnel termination processes.
  11. IAC-08_A11 account management processes are aligned with personnel transfer processes.
  12. IAC-08_A12 account managers and organization-defined personnel or roles are notified within an organization-defined time period when accounts are no longer required.
  13. IAC-08_A13 account managers and organization-defined personnel or roles are notified within an organization-defined time period when users are terminated or transferred.
  14. IAC-08_A14 account managers and organization-defined personnel or roles are notified within an organization-defined time period when system usage or the need to know changes for an individual.
  15. IAC-08_A15 access to the system is authorized based on a valid access authorization.
  16. IAC-08_A16 access to the system is authorized based on intended system usage.
  17. IAC-08_A17 access to the system is authorized based on organization-defined attributes (as required).
  18. IAC-08_A18 the use of system accounts is monitored.
  19. IAC-08_A19 system accounts are disabled when the accounts have expired.
  20. IAC-08_A20 system accounts are disabled when the accounts have been inactive for <A.03.01.01.ODP[01]: time period>.
  21. IAC-08_A21 system accounts are disabled when the accounts are no longer associated with a user or individual.
  22. IAC-08_A22 system accounts are disabled when the accounts violate organizational policy.
  23. IAC-08_A23 system accounts are disabled when significant risks associated with individuals are discovered.
  24. IAC-08_A24 account types specifically prohibited for use within the system are defined and documented.
  25. IAC-08_A25 the types of transactions and functions that authorized users are permitted to execute are defined.
  26. IAC-08_A26 personnel or roles required to approve requests to create accounts is/are defined.
  27. IAC-08_A27 criteria for account creation, enabling, modification, disabling and removal are defined.
  28. IAC-08_A28 account types allowed for use within the system are defined and documented.
  29. IAC-08_A29 account managers are assigned.
  30. IAC-08_A30 system access is limited to the defined types of transactions and functions for authorized users.
  31. IAC-08_A31 prerequisites and criteria for group and role membership are defined.
  32. IAC-08_A32 attributes (as required) for each account are defined.
  33. IAC-08_A33 personnel or roles required to approve requests to create accounts is/are defined.
  34. IAC-08_A34 personnel or roles to be notified is/are defined.
  35. IAC-08_A35 time period within which to notify account managers when accounts are no longer required is defined.
  36. IAC-08_A36 time period within which to notify account managers when users are terminated or transferred is defined.
  37. IAC-08_A37 time period within which to notify account managers when system usage or the need to know changes for an individual is defined.
  38. IAC-08_A38 attributes needed to authorize system access (as required) are defined.
  39. IAC-08_A39 the frequency of account review is defined.
  40. IAC-08_A40 organization-defined prerequisites and criteria for group and role membership are required.
  41. IAC-08_A41 authorized users of the system are specified.
  42. IAC-08_A42 group and role membership are specified.
  43. IAC-08_A43 access authorizations (e.g., privileges) are specified for each account.
  44. IAC-08_A44 organization-defined attributes (as required) are specified for each account.
  45. IAC-08_A45 a process is established for changing shared or group account authenticators (if deployed) when individuals are removed from the group.
  46. IAC-08_A46 a process is implemented for changing shared or group account authenticators (if deployed) when individuals are removed from the group.
  47. IAC-08_A47 the time period for account inactivity before disabling is defined.
  48. IAC-08_A48 system account types allowed are defined.
  49. IAC-08_A49 system account types prohibited are defined.
  50. IAC-08_A50 account managers and designated personnel or roles are notified within <A.03.01.01.ODP[02]: time period> when accounts are no longer required.
  51. IAC-08_A51 account managers and designated personnel or roles are notified within <A.03.01.01.ODP[03]: time period> when users are terminated or transferred.
  52. IAC-08_A52 account managers and designated personnel or roles are notified within <A.03.01.01.ODP[04]: time period> when system usage or the need-to-know changes for an individual.
  53. IAC-08_A53 a new password is selected upon first use after account recovery.

Evidence Requirements

E-IAC-07 Account Management Compliance Reviews

Documented evidence of account management compliance reviews.

Identity & Access Management
E-IAC-08 Conditions for Group / Role Membership

Documented evidence of conditions for group and role membership.

Identity & Access Management
E-IAC-12 Account Management Documentation

Documented evidence of list of account management practices.

Identity & Access Management

Technology Recommendations

Micro/Small

  • Microsoft Active Directory
  • Microsoft Entra
  • AWS IAM

Small

  • Microsoft Active Directory
  • Microsoft Entra
  • AWS IAM

Medium

  • Microsoft Active Directory
  • Microsoft Entra
  • AWS IAM

Large

  • Microsoft Active Directory
  • Microsoft Entra
  • AWS IAM

Enterprise

  • Microsoft Active Directory
  • Microsoft Entra
  • AWS IAM

The Secure Controls Framework (SCF) is maintained by SCF Council. Use of SCF content is subject to the SCF Terms & Conditions.

Manage this control in SCF Connect

Track implementation status, collect evidence, and map controls to your compliance frameworks automatically.

Get Started Free