Frequently Asked Question

What is an "inactive user account" as used in PCI DSS Requirement 8?

An inactive user account is one that has not been used in over 90 days. Inactive accounts are often targets for attackers since they are generally not monitored, and changes to the accounts (such as a changed password) could easily go unnoticed.

Removing or disabling inactive accounts reduces the risk that they will be used to gain unauthorized access to the environment.

Note: The specific sub requirement number(s) and terminology may vary depending on the version of the standard being used.

Last updated: August 2022
Originally published: April 2012
Article Number: 1066

Featured FAQ Articles