Overview

Security Requirements for 03.05.06 Identifier Handling

Inactive identifiers pose a risk to organizational information because attackers may exploit an inactive identifier to gain undetected access to organizational devices. The owners of the inactive accounts may not notice if unauthorized access to the account has been obtained.

Evidence

  1. 03.05.06.a

    A period of inactivity after which an identifier is disabled is defined

  1. 03.05.06.b

    Identifiers are disabled after the defined period of inactivity