myctrl.tools
Compare

AC-2(3)—Disable Accounts

MODERATE
HIGH

>Control Description

Disable accounts within ⚙organization-defined time period when the accounts: a. Have expired; b. Are no longer associated with a user or individual; c. Are in violation of organizational policy; or d. Have been inactive for ⚙organization-defined time period.

>Cross-Framework Mappings

SCF

IAC-15.3
Compare

>Programmatic Queries

Beta

Related Services

IAM
AWS Config
AWS Lambda

CLI Commands

Generate credential report for inactivity check
aws iam generate-credential-report && aws iam get-credential-report --query 'Content' --output text | base64 -d
Deactivate access key for inactive user
aws iam update-access-key --user-name USERNAME --access-key-id KEY_ID --status Inactive
Delete login profile to disable console access
aws iam delete-login-profile --user-name USERNAME
List Config rules for IAM compliance
aws configservice describe-config-rules --query "ConfigRules[?contains(ConfigRuleName,'iam')]"
Open AWS ConsoleDocumentation

>Supplemental Guidance

Disabling expired, inactive, or otherwise anomalous accounts supports the concepts of least privilege and least functionality which reduce the attack surface of the system.

>Assessment Interview Topics

Questions assessors commonly ask

Process & Governance:

  • •What formal policies and procedures govern the implementation of AC-2(3) (Disable Accounts)?
  • •Who are the designated roles responsible for implementing, maintaining, and monitoring AC-2(3)?
  • •How frequently is the AC-2(3) policy reviewed and updated, and what triggers policy changes?
  • •What training or awareness programs ensure personnel understand their responsibilities related to AC-2(3)?

Technical Implementation:

  • •Describe the specific technical mechanisms or controls used to enforce AC-2(3) requirements.
  • •What automated tools, systems, or technologies are deployed to implement AC-2(3)?
  • •How is AC-2(3) integrated into your system architecture and overall security posture?
  • •What configuration settings, parameters, or technical specifications enforce AC-2(3) requirements?

Evidence & Documentation:

  • •What documentation demonstrates the complete implementation of AC-2(3)?
  • •What audit logs, records, reports, or monitoring data validate AC-2(3) compliance?
  • •Can you provide evidence of periodic reviews, assessments, or testing of AC-2(3) effectiveness?
  • •What artifacts would you present during a FedRAMP assessment to demonstrate AC-2(3) compliance?

Ask AI

Configure your API key to use AI features.