NIST SP 800-53 Rev. 5 · Access Control
AC-2(3) — Disable Accounts
Stale privileged access. Published queries for three platforms, each with the evidence it needs and the limits of what it shows.
Why this matters
An administrator account nobody has used in months, still holding full powers
Administrative access tends to be granted for a project, a migration, or an emergency, and then never withdrawn. The person moved to another team, or the work finished, but the account keeps its powers. It is not being used, which is exactly why nobody notices it — and an unused account with full powers is a quiet prize for anyone who obtains its password.
Why this check earns its place. Dormancy is the signal. An administrator using their access daily is doing their job; one who has not signed in for months almost certainly does not need the access, and the check reports the second without pestering the first.
- What it reads
- The organization's list of who holds administrative roles, compared against its record of who has actually signed in.
- What it reports
- Accounts holding administrative powers that nobody has signed into for longer than the organization allows.
See related public disclosures on the Signals page →
The requirement
The organization must disable accounts within an organization-defined time period when the account has been inactive for an organization-defined period, has expired, or is no longer associated with a user or role.
NIST SP 800-53 Rev. 5 — AC-2(3) (Account Management | Disable Accounts).
NIST requires inactive accounts to be disabled within a defined period but does not set the period. The 90-day threshold, the definition of privileged, and break-glass exclusions are local parameters.
What a check finds
Privileged role held by an identity with no successful authentication inside the inactivity threshold.
Choose your platform
CISA performance goals
- 3.H — Implement the principles of least privilege
- 3.D — Revoke credentials for departing staff (partial)
What a result does not prove
Inactivity alone does not establish that access is unnecessary. Missing activity may reflect licensing, retention limits, non-interactive use, or an authentication path outside the queried source.