Frequently Asked Question

An inactive user account is one that has not been used in over 90 days. Inactive accounts are often targets for attackers since they are generally not monitored, and changes to the accounts (such as a changed password) could easily go unnoticed.

Removing or disabling inactive accounts reduces the risk that they will be used to gain unauthorized access to the environment.

Note: The specific sub requirement number(s) and terminology may vary depending on the version of the standard being used.