Assessor Finding on Account Management and Stale Inherited Audit Evidence
An independent assessment of a Moderate system samples 25 of 600 accounts for AC-2. Twenty-three have documented authorization and review within 90 days. Two are service accounts with no named owner and last review 14 months ago; the identity team says they are disabled but not deleted, and the automated review tool excludes them. For inherited AU-6, the shared SOC's most recent assessment is 26 months old, while the agency's ConMon strategy requires annual review. The assessor drafts 'other than satisfied' for AC-2 and 'satisfied' for AU-6 based on the SOC's prior report. The system owner wants both changed to 'satisfied with a finding' so the ATO can proceed.
1. Evaluate the assessor's proposed results for AC-2 and AU-6. What should the SAR show?
Read the worked answer
AC-2: The assessor's 'other than satisfied' is defensible. Two accounts lack a named owner and have not been reviewed within the required period. Disabling an account does not satisfy account review, ownership, or removal requirements. The SAR should show the sample size, the two exceptions, why the automated tool did not catch them, and the affected control components.
AU-6: 'Satisfied' is not supported by a 26-month-old SOC assessment when the ConMon strategy requires annual review. An inherited control still needs current evidence. The assessor should obtain an updated SOC report, a current attestation, or perform sufficient procedures. If current evidence cannot be obtained, AU-6 should be 'other than satisfied' or otherwise not credited as inherited until evidence exists.
The SAR should record the result, evidence examined, affected population, and finding. 'Satisfied with a finding' is not a standard SP 800-53A assessment result; it conflates assessment with the AO's risk decision. Findings accompany 'other than satisfied' results and feed the POA&M.
2. What are the roles of the assessor, the AO, and the system owner in resolving the disagreement?
Read the worked answer
The assessor independently determines whether the control is satisfied based on evidence and the assessment procedures. The assessor should not change a result because the system owner or AO prefers a different outcome.
The system owner provides evidence, explains context, remediates, and documents the POA&M. The system owner can dispute facts, but not direct the assessor to alter the conclusion.
The AO considers the SAR, the POA&M, and residual risk and decides whether to authorize, authorize with conditions, or deny. The AO may accept the risk of an AC-2 exception, but that does not convert the assessment result to 'satisfied.' If the AO believes the assessor's result is wrong, the AO can request a documented technical review, not a political edit.
The resolution should be written: what was found, what evidence supports it, what will be fixed, by when, and who accepted the residual risk. That record protects all three roles.
3. If the two service accounts are confirmed disabled, could AC-2 be satisfied? Explain.
Read the worked answer
Possibly, but not automatically. AC-2 requires account management activities including authorization, review, and removal or disabling when no longer required. If the accounts are confirmed disabled, the immediate access risk is reduced, but the control also addresses account ownership, review, and lifecycle management.
The assessor should determine:
- Whether the accounts are truly disabled and cannot be re-enabled without proper approval.
- Whether disabling satisfies the agency's account review requirement or whether the accounts should be deleted.
- Whether the lack of a named owner and the 14-month review gap are isolated or a systemic tooling problem.
- Whether the automated review tool's exclusion of service accounts is itself a control gap.
A reasonable outcome could be 'other than satisfied' with a lower-severity finding if the accounts are disabled, or 'satisfied' if the agency provides evidence that the accounts were reviewed, authorized, and properly disabled under an approved process. The judgment must be based on evidence, not on the system owner's assurance alone.