AC-2(3): Disable Accounts

Control Family:

Access Control

Parent Control:

AC-2: Account Management

CSF v1.1 References:

Threats Addressed:

Baselines:

  • Moderate
  • High

Previous Version:

Control Statement

Disable accounts within [Assignment: organization-defined time period] when the accounts:

  1. Have expired;
  2. Are no longer associated with a user or individual;
  3. Are in violation of organizational policy; or
  4. Have been inactive for [Assignment: organization-defined time period].

Supplemental Guidance

Disabling expired, inactive, or otherwise anomalous accounts supports the concepts of least privilege and least functionality which reduce the attack surface of the system.

Related Controls

Critical Security Controls Version 8

Critical Security Controls Version 7.1