CMMC Practice IA.L2-3.5.6

Disable identifiers after a defined period of inactivity.

Bold Coast Security Guidance

The identification and elimination of stale accounts is a standard practice. Typical time frames range from 30-90 days before the account is disabled. You may consider a multi-step review in which the account is disabled after 30 days, and then deleted after 90 days. Additionally, identify accounts which have never logged on. These should be disabled in a much shorter time frame, such as seven days or less. These often represent accounts created for new hires who never showed up.

Discussion From Source

DRAFT NIST SP 800-171 R2 Inactive identifiers pose a risk to organizational information because attackers may exploit an inactive identifier to gain undetected access to organizational devices. The owners of the inactive accounts may not notice if unauthorized access to the account has been obtained.