AC-2(3)
AC-2(3): Disable Accounts
Disable accounts within [time period within which to disable accounts is defined;] when the accounts:
- (a): Have expired;
- (b): Are no longer associated with a user or individual;
- (c): Are in violation of organizational policy; or
- (d): Have been inactive for [time period for account inactivity before disabling is defined;].
Supplemental
Disabling expired, inactive, or otherwise anomalous accounts supports the concepts of least privilege and least functionality which reduce the attack surface of the system.
| CIA Levels | |
|---|---|
| Confidentiality | moderate |
| Integrity | moderate |
| Availability | unknown |
| Overlays |
|---|
| CMMC, Int-A, Int-B, Int-C, Privacy (high), Privacy (moderate) |
| CSF Categories |
|---|
| None |