NIST SP 800-171 & CMMC 2.0 Control 3.5.6 Requirement:
Disable identifiers after a defined period of inactivity.
NIST SP 800-171 & CMMC 2.0 3.5.6 Requirement Explanation:
Accounts that have not been logged into for a certain period of time (90 days) may no longer be needed. Leaving them active increases your attack surface, as a result, all accounts that have been inactive for a defined period should be disabled.
Example NIST SP 800-171 & CMMC 2.0 3.5.6 Implementation:
Create a policy requiring you to disable accounts after a period of inactivity (e.g., 90 days). You can manually disable accounts however in a large organizations with hundreds or thousands of accounts use of an automated tool may be justified. If you use active directory to manage your user accounts you can create a script to automatically disable inactive accounts.
NIST SP 800-171 & CMMC 2.0 3.5.6 Scenario(s):
- Scenario 1:
Your company policy requires that accounts that have been inactive for 90 days must be disabled. To enforce this policy you review the user accounts in Microsoft 365 every 90 days, and disable accounts that have been inactive for 90 days.
Discover Our NIST SP 800-171 & CMMC 2.0 Solutions:
Power through compliance. Meet and maintain your NIST SP 800-171 & CMMC 2.0 compliance requirements.
Transform your business. Create new revenue streams and provide scalability for your NIST SP 800-171 and CMMC 2.0 services.
Supply Chain Verifier
Trust is everything. Verify, monitor, and support subcontactor compliance.