API 1164 PR.AC-1: PR.AC-1 Identity lifecycle management for human, device and process accounts; authentication on every interface

The plan must require identity lifecycle management for every account and credential, whether held by a person, a device or a process; identification and authentication of every human user before logical access to a segregated environment or its assets on every human-access interface (network protocols, integrated and serial consoles, programmer interfaces); management of shared functional accounts in line with the risk strategy; accounts no longer needed made unusable within a time frame set by the strategy; protection of authenticators at rest and in transit; authenticator strength matched to risk (complexity, length, reuse, key expiry); and modification of default accounts before use in a security zone. At the Enhanced Profile each human user carries a unique identity and is authenticated individually where technically supported, with risk-appropriate compensating controls where not, and identity and credential management generates log events (such as failed authentication) detailed enough for auditing.