IncidentResponsev2

Request Network Accounts Task

Purpose

Gain necessary access to mission partner networks and systems for incident response activities.

Standards

• Identify account types required.
• Establish access conditions and approval process.
• Gain access based on authorization and need-to-know.
• Monitor and remove accounts as needed.

Procedural Steps (Checklist)

Identify Account Requirements

• Determine needed access for IR activities.
• Confirm with mission partner POC:
  • End-user access
  • Shared credentials
  • Service accounts

Submit Account Requests

• Assign team member as Account Manager.
• Complete request forms (e.g. DD Form 2875).
• Submit request through mission partner process.

Validate Access and Use

• Confirm accounts provide necessary access.
• Monitor use during mission.
• Notify partner of any issues or changes.

Deactivate Accounts Post-Mission

• Request account deactivation.
• Validate closure in mission closeout.

Tools and Resources

Purpose	Tools
Access request	DD Form 2875
Documentation	SharePoint, Confluence

References

• DD Form 2875.pdf
• NIST.SP.800-53r4

Revision History

Date	Version	Description	Author
2025-05-02	1.1	Expanded with procedural checklist and account management guidance	Leo