3.1.2 Limit system access to the types of transactions and functions that authorized users are permitted to execute.

Organizations may choose to define access privileges or other attributes by account, by type of account, or a combination of both. System account types include individual, shared, group, system, anonymous, guest, emergency, developer, manufacturer, vendor, and temporary. Other attributes required for authorizing access include restrictions on time-of-day, day-of-week, and point-of-origin. In defining other account attributes, organizations consider system-related requirements (e.g., system upgrades scheduled maintenance,) and mission or business requirements, (e.g., time zone differences, customer requirements, remote access to support travel requirements).

Using Windows Server with Active Directory: By extensive use of User Groups. Do not use any users directly in assigning access to anything. Individual user access to specific machines and times can be controlled in user access at to times and machines they can log onto.

Monitoring: There is monitoring software available to monitor activity in group assignments to ensure compliance.