ComplianceNIST 800-53 enhancement
NIST-AC-2(3) Disable Accounts
- Framework
- NIST SP 800-53 rev5 (5.2.0)
- Family
- AC Access Control
- Control
- AC-2(3)
Control statement
Disable accounts within [Assignment: time period] when the accounts:
(a) Have expired;
(b) Are no longer associated with a user or individual;
(c) Are in violation of organizational policy; or
(d) Have been inactive for [Assignment: time period].
Discussion
Disabling expired, inactive, or otherwise anomalous accounts supports the concepts of least privilege and least functionality which reduce the attack surface of the system.
Related
Enhancement of · Compliance (1)
- NIST-AC-2 Account Management NIST 800-53 control