Navigate

CCI-000017

CCI-000017 Definition

Disable accounts when the accounts have been inactive for the organization-defined time-period.

Status
Type	CheckType.technical

Master Assessment Datasheet

Implementation Guidance

Determine if accounts are disabled within [AC-02(03)_ODP[01]; time period within which to disable accounts is defined] when the accounts have been inactive for [AC-02(03)_ODP[02]; time period for account inactivity before disabling is defined].

Validation Procedures

Examine: [SELECT FROM: Access control policy; procedures for addressing account management; system security plan; system design documentation; system configuration settings and associated documentation; system-generated list of accounts removed; system-generated list of emergency accounts disabled; system audit records; system security plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with account management responsibilities; system/network administrators; organizational personnel with information security responsibilities; system developers]. Test: [SELECT FROM: Mechanisms for implementing account management functions].

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-000017.

Control	Description
AC-2(3)	Disable accounts within [time period within which to disable accounts is defined;] when the accounts: (a): Have expired; (b): Are no longer associated with a user or individual; (c): Are in violation of organizational policy; or (d): Have been inactive for [time period for account inactivity before disabling is defined;].