AC-2(3)—Account Management | Disable Accounts

IL4 Mod

IL4 High

IL5

IL6

>Control Description

Disable accounts within ⚙organization-defined time period when the accounts: (a) Have expired; (b) Are no longer associated with a user or individual; (c) Are in violation of organizational policy; or (d) Have been inactive for ⚙organization-defined time period.

>DoD Impact Level Requirements

FedRAMP Parameter Values

AC-2 (3) [24 hours for user accounts] AC-2 (3) (d) [thirty-five (35) days] (See additional requirements and guidance.)

Additional Requirements and Guidance

AC-2 (3) Requirement: The service provider defines the time period for non-user accounts (e.g., accounts associated with devices). The time periods are approved and accepted by the JAB/AO. Where user management is a function of the service, reports of activity of consumer users shall be made available. AC-2 (3) (d) Requirement: The service provider defines the time period of inactivity for device identifiers. Guidance: For DoD clouds, see DoD cloud website for specific DoD requirements that go above and beyond FedRAMP https://public.cyber.mil/dccs/.

>Discussion

Disabling expired, inactive, or otherwise anomalous accounts supports the concepts of least privilege and least functionality which reduce the attack surface of the system.

>Programmatic Queries

Beta

Related Services

IAM

AWS Config

AWS Lambda

CLI Commands

Generate credential report for inactivity check

aws iam generate-credential-report && aws iam get-credential-report --query 'Content' --output text | base64 -d

Deactivate access key for inactive user

aws iam update-access-key --user-name USERNAME --access-key-id KEY_ID --status Inactive

Delete login profile to disable console access

aws iam delete-login-profile --user-name USERNAME

List Config rules for IAM compliance

aws configservice describe-config-rules --query "ConfigRules[?contains(ConfigRuleName,'iam')]"

Open AWS Console Documentation

>Assessment Interview Topics

Questions assessors commonly ask

Process & Governance:

•What formal policies and procedures govern the implementation of AC-2(3) (Disable Accounts)?
•Who are the designated roles responsible for implementing, maintaining, and monitoring AC-2(3)?
•How frequently is the AC-2(3) policy reviewed and updated, and what triggers policy changes?
•What training or awareness programs ensure personnel understand their responsibilities related to AC-2(3)?

Technical Implementation:

•Describe the specific technical mechanisms or controls used to enforce AC-2(3) requirements.
•What automated tools, systems, or technologies are deployed to implement AC-2(3)?
•How is AC-2(3) integrated into your system architecture and overall security posture?
•What configuration settings, parameters, or technical specifications enforce AC-2(3) requirements?

Evidence & Documentation:

•What documentation demonstrates the complete implementation of AC-2(3)?
•What audit logs, records, reports, or monitoring data validate AC-2(3) compliance?
•Can you provide evidence of periodic reviews, assessments, or testing of AC-2(3) effectiveness?
•What artifacts would you present during a FedRAMP assessment to demonstrate AC-2(3) compliance?

Ask AI

Configure your API key to use AI features.