5.6
IG2 IG3

Centralize Account Management

Control Group: 5. Account Management
Asset Type: Users
Security Function: Protect

Description

Centralize account management through a directory or identity service.

Implementation Checklist

1
Assess current protection controls in place
2
Configure and deploy required security controls
3
Test control effectiveness in non-production environment
4
Deploy to production and verify functionality
5
Document configuration and operational procedures
6
Select centralized management platform
7
Integrate all in-scope systems and data sources
8
Configure dashboards and reporting

Threats & Vulnerabilities (CIS RAM)

Threat Scenarios

Inconsistent Account Policies Across Decentralized Systems

Confidentiality

Local accounts on individual systems bypass centralized security policies like password complexity, lockout thresholds, and MFA requirements, creating weak access points.

Unmanaged Local Accounts as Persistent Backdoors

Integrity

Attackers create local accounts on compromised systems that exist outside centralized directory services, establishing persistence that survives directory-level password resets.

Vulnerabilities (When Safeguard Absent)

Decentralized Account Management

Without centralized account management through a directory service, accounts are managed independently on each system with inconsistent security policies and no unified visibility.

No Single Source of Truth for Identity

Without a centralized identity service, user provisioning, deprovisioning, and access reviews must be performed system-by-system, leading to errors and orphaned access.

Evidence Requirements

Type Evidence Item Collection Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Document Governing policy document (current, approved, communicated) Reviewed annually