Establish and maintain an inventory of service accounts. The inventory, at a minimum, must contain
department owner, review date, and purpose. Perform service account reviews to validate that all
active accounts are authorized, on a recurring schedule at a minimum quarterly, or more frequently.
The organization adapts asset inventory documentation practices to include pertinent details such as the department owner, review date, and account purpose.
The organization conducts regular reviews of data system access rights and validates that all active service accounts are authorized. An owner is assigned for each service account, drawing from the practice of listing data system owners, who are tasked with completing the necessary documentation and security actions.