Service Account

Service accounts configured with an SPN use the Advanced Encryption Standard for encryption.

Keep an inventory of service accounts that records at least the owning department, review date and purpose, and confirm at least quarterly that every active service account is authorised. Implementation Groups: IG2 and IG3 (not in the IG1 baseline;

Keep a register of service accounts that records, at a minimum, the owning department, the date of review and the purpose. Review service accounts on a regular cycle of at least once a quarter to confirm that every active one is authorised.

Credentials for break glass accounts, local administrator accounts and service accounts are long, unique, unpredictable and managed. Required at Maturity Levels Two and Three of the Restrict administrative privileges mitigation strategy (Appendices B and C);

Service accounts, if used, are managed to prevent their use to gain logical access to applications, databases and operating systems, with the method documented by a named employee and available to auditors and the Board;

Test regularly that logging works; maintain and review number analysis reference data used to configure signalling equipment; conduct threat modelling to inform risk assessments;