`AC-02(03)` Disable Accounts

NIST SP 800-53 (controls) 5.2.0 against 5.2.0
All changes in this version

unchanged AC Moderate baseline High baseline part of AC-2

Title

Disable Accounts

Control

Disable accounts within [Assignment: time period] when the accounts:
(a) Have expired;
(b) Are no longer associated with a user or individual;
(c) Are in violation of organizational policy; or
(d) Have been inactive for [Assignment: time period].

Discussion

Disabling expired, inactive, or otherwise anomalous accounts supports the concepts of least privilege and least functionality which reduce the attack surface of the system.

Parameters

ac-02.03_odp.01: time period
ac-02.03_odp.02: time period

STIG rules that implement this control 12

Apple macOS 15 (Sequoia) V1R8

APPL-15-003080 CAT II The macOS system must disable accounts after 35 days of inactivity.

Apple macOS 26 (Tahoe) V1R4

APPL-26-003080 CAT II The macOS system must disable accounts after 35 days of inactivity.

Application Security and Development V6R5

APSC-DV-000320 CAT III The application must automatically disable accounts after a 35 day period of account inactivity.
APSC-DV-000330 CAT II Unnecessary application accounts must be disabled, or deleted.
APSC-DV-001670 CAT II The application must disable device identifiers after 35 days of inactivity unless a cryptographic certificate is used for authentication.

Canonical Ubuntu 22.04 LTS V2R10

UBTU-22-411035 CAT II Ubuntu 22.04 LTS must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.

Canonical Ubuntu 24.04 LTS V1R7

UBTU-24-200260 CAT II Ubuntu 24.04 LTS must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.

Microsoft Windows 11 V2R11

WN11-00-000065 CAT III Unused accounts must be disabled or removed from the system after 35 days of inactivity.

Microsoft Windows Server 2022 V2R11

WN22-00-000190 CAT II Windows Server 2022 outdated or unused accounts must be removed or disabled.

Microsoft Windows Server 2025 V1R4

WN25-00-000190 CAT II Outdated or unused accounts on Windows Server 2025 must be removed or disabled.

Red Hat Enterprise Linux 10 V1R3

RHEL-10-600160 CAT II RHEL 10 must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.

Red Hat Enterprise Linux 9 V2R10

RHEL-09-411050 CAT II RHEL 9 must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.

AC-02(03) Disable Accounts