manage.get.gov/docs/compliance/dist/system-security-plans/ato/ac-2.3.md

implementation-status	control-origination
c-not-implemented	c-inherited-cloud-gov c-inherited-cisa c-common-control c-system-specific-control

ac-2.3 - [catalog] Disable Accounts

Control Statement

Disable accounts within time period when the accounts:

• [a] Have expired;

• [b] Are no longer associated with a user or individual;

• [c] Are in violation of organizational policy; or

• [d] Have been inactive for time period.

Control guidance

Disabling expired, inactive, or otherwise anomalous accounts supports the concepts of least privilege and least functionality which reduce the attack surface of the system.

Control assessment-objective

accounts are disabled within time period when the accounts have expired; accounts are disabled within time period when the accounts are no longer associated with a user or individual; accounts are disabled within time period when the accounts are in violation of organizational policy; accounts are disabled within time period when the accounts have been inactive for time period.

---

What is the solution and how is it implemented?

---

Implementation (a)

Add control implementation description here for item ac-2.3_smt.a

---

Implementation (b)

Add control implementation description here for item ac-2.3_smt.b

---

Implementation (c)

Add control implementation description here for item ac-2.3_smt.c

---

Implementation (d)

Add control implementation description here for item ac-2.3_smt.d

---