8.2.7User identification and related accounts for users and administrators are strictly managed throughout an account’s lifecycle

Defined Approach Requirements:

Accounts used by third parties to access, support, or maintain system components via remote access are managed as follows:

- Enabled only during the time period needed and disabled when not in use.

- Use is monitored for unexpected activity.

Defined Approach Testing Procedures:

8.2.7 Interview personnel, examine documentation for managing accounts, and examine evidence to verify that accounts used by third parties for remote access are managed according to all elements specified in this requirement.