Access Control¶
13 control(s) in this category.
| Control | Title | Severity | Type |
|---|---|---|---|
| 389-AC-001 | Ensure strong password complexity requirements for all users. | high | preventive |
| 389-AC-002 | Enforce password expiration policy for user accounts. | high | preventive |
| 389-AC-003 | Restrict admin privileges to necessary personnel only. | high | preventive |
| 389-AC-004 | Implement account lockout after a set number of failed login attempts. | medium | preventive |
| 389-AC-005 | Enforce session timeout for idle users. | medium | preventive |
| 389-AC-006 | Enforce a minimum password length for enhanced security. | high | preventive |
| 389-AC-007 | Limit the maximum password lifetime to enforce regular password changes. | medium | preventive |
| 389-AC-008 | Restrict password reuse to prevent cycling through recent passwords. | high | preventive |
| 389-AC-009 | Configure account lockout duration and failure-counter reset window. | medium | preventive |
| 389-AC-010 | Require passwords to contain at least one uppercase letter. | high | preventive |
| 389-AC-011 | Require passwords to contain at least one lowercase letter. | high | preventive |
| 389-AC-012 | Require passwords to contain at least one numeric character. | high | preventive |
| 389-AC-013 | Require passwords to contain at least one special character. | high | preventive |