SFS 1 / SF A

Back to SFS 1

Status: Question model review passed; solution and completed SF authoring pending.

This is a generated authoring draft. Human approval and operational assessment results have not been supplied.

Question

Are emergency administrator credentials deactivated immediately after each authorized use throughout the review period?

Plain-language explanation

Model-reviewed question draft. Completed explanations and a canonical solution are pending. The proposed positive criterion is: Documented evidence shows emergency credentials were deactivated within one hour of each authorized use

Assessment criterion and evidence

Actor: Organization's emergency access management process. Scope: All emergency administrator credentials across organizational systems. Evidence period: the review period. Required evidence: Session logs demonstrating time-bound activation of emergency credentials; Policy documentation specifying immediate post-use deactivation requirements. Negative criterion: Emergency credentials remained active beyond the necessary access timeframe after authorized use. Missing evidence: Records of deactivation timing for emergency credential sessions are unavailable

View the JSON record (opens in a new tab).

Assessment result: unset.