Privileged User Accounts (AC-2(7))

Establish and administer privileged user accounts in accordance with [organization-defined]; Monitor privileged role or attribute assignments; Monitor changes to roles or attributes; and Revoke access when privileged role or attribute assignments are no longer appropriate.