CMMC Practice IA.L2-3.5.6

Disable identifiers after a defined period of inactivity.

Bold Coast Security Guidance

The identification and elimination of stale accounts is a standard practice. Typical time frames range from 30-90 days before the account is disabled. You may consider a multi-step review in which the account is disabled after 30 days, and then deleted after 90 days. Additionally, identify accounts which have never logged on. These should be disabled in a much shorter time frame, such as seven days or less. These often represent accounts created for new hires who never showed up.

Security Catapult

Be prepared for CMMC

Our Q&A assessment tool is designed by security advisors for MSPs and DoD contractors of all sizes.

Try now for free

Security Catapult

Understand your gaps

See compliance gaps, compliance scores and proactive security tasks in a single interface.

Try now for free

Security Catapult

Validate NIST SP 800-171

Based on your CMMC answers, we let you know where you stand on NIST.

Try now for free

Security Catapult

Build a plan of action

Track your burn down and stay on top of security needs.

Try now for free

Security Catapult

Build your policy

Say goodbye to maintaining a security policy. We do it for you.

Try now for free

Discussion From Source

DRAFT NIST SP 800-171 R2 Inactive identifiers pose a risk to organizational information because attackers may exploit an inactive identifier to gain undetected access to organizational devices. The owners of the inactive accounts may not notice if unauthorized access to the account has been obtained.