NIST SP 800-53 Rev. 5 · Access Control

AC-2 on Splunk

Residual access after termination — a published SPL query you can run against Splunk Enterprise / Enterprise Security, with the evidence it needs, the settings you decide, and what a result does and does not establish.

Why this matters

A departed employee whose access was never switched off

When someone leaves an organization, their accounts are supposed to be disabled. In practice the human resources record and the computer system are often maintained by different people using different tools, and accounts survive departures. Those accounts are a recurring feature of real breach reports.

Why this check earns its place. It requires joining two sources that do not normally talk to each other — the staff record and the directory. That join is the work most small organizations cannot do for themselves.

What it reads: The organization's staff-departure records joined to its user directory.
What it reports: Accounts still active after the person's recorded departure date.

See related public disclosures on the Signals page →

ControlAC-2 — Account Management

PlatformSplunk (SPL)

SeverityHigh

ValidationLab-validated

What this finds

Identity still enabled after the recorded termination date, with no unexpired access extension.

The requirement

The organization must disable or remove information system accounts when an individual is terminated, transferred, or otherwise no longer requires access, within an organization-defined time period.
NIST SP 800-53 Rev. 5 — AC-2 (Account Management).

NIST states the objective. The authoritative lifecycle source, the subject-matching identifier, the permitted grace period, and the exception workflow are all organization-defined — not NIST-prescribed values.

How this maps to the CISA performance goals

The Cross-Sector Cybersecurity Performance Goals are a voluntary baseline published by CISA — the U.S. federal agency for critical-infrastructure cybersecurity — written for organizations too small to employ security staff. This control speaks to:

3.D — Revoke credentials for departing staff
The goal is revoking access when someone leaves; the pack finds access that outlived a termination.

See the full coverage map, including the goals no query can answer →

Evidence this query needs

HR termination events `hr_termination_events.csv`

Establishes when an individual's employment ended so directory state can be compared against it. Without this file, an enabled account is just an enabled account — there is nothing to compare it to.

Minimum fields: user_principal_name, employment_status, effective_date

A UPN, a status, and a date are enough to run the check. Everything else improves the reviewer's ability to dismiss a false positive without going back to HR.

The query

Published as ac-2-residual-access.splunk.spl. Reads index=identity (directory), hr_termination_events.csv (lookup). Requires: Search access to the identity index; Read on the lookup.

Before this returns anything, index=identity (directory) has to be reaching Splunk Enterprise / Enterprise Security, and hr_termination_events.csv (lookup) has to be landed there. If not, the query reports nothing found — which looks exactly like nothing wrong. What has to be switched on first →

index=identity sourcetype=directory:users
| dedup user_principal_name
| eval user_key=lower(user_principal_name)
| lookup hr_termination_events.csv user_principal_name AS user_key
    OUTPUT employment_status, effective_date, retain_access_until
| where employment_status="terminated" AND account_enabled="true"
| eval eff_epoch=strptime(effective_date,"%Y-%m-%d")
| eval retain_epoch=if(isnull(retain_access_until) OR retain_access_until="",
                       0, strptime(retain_access_until,"%Y-%m-%d"))
| where eff_epoch < now() AND retain_epoch < now()
| eval days_since_termination=round((now()-eff_epoch)/86400)
| table user_principal_name, display_name, source_system,
        effective_date, retain_access_until, days_since_termination
| sort - days_since_termination

Open this pack on Splunk to adjust the settings and download it →

The interactive version opens on Splunk — the platform on this page — even if your environment profile does not list it.

Settings you decide

NIST states the objective and leaves these to your organization. The interactive version of this pack applies them to the query for you.

Disablement grace period (days) (default 0): Accounts are only reported once this many days have passed since the effective termination date.
Limit to specific accounts (optional): Paste user principal names, one per line, to scope the query to a defined population.

What this query returned when it was run

Executed against Splunk Enterprise 10.4.2 on 2026-08-07 against purpose-built test data. The software examined 5 records and returned 2 results in 0.095 seconds.

user_principal_name	display_name	source_system	effective_date	days_since_termination
[email protected]	J Okafor	Active Directory (via Splunk)	2026-06-05	64
[email protected]	P Lindqvist	Active Directory (via Splunk)	2026-07-18	21

Test data, not a real organization. It shows the query executes and returns the intended shape of result.

Running it continuously

Correlation search → notable event

Search type:      Correlation search (Enterprise Security)
Cron schedule:    0 * * * *   (hourly)
Time range:       -24h to now
Trigger:          Number of results > 0
Alert action:     Create notable event
Urgency:          High
Security domain:  Access
Drill-down:       index=identity user_principal_name="$user_principal_name$"
Throttling:       Suppress 24h on user_principal_name

Throttling on the account field stops the same unresolved identity re-alerting every hour while review is in progress.

What a result does not prove

An enabled account does not by itself establish unauthorized access or a control failure. Identifier quality, export timing, and accounts held in other directories all remain contextual.

Validation status for this platform: Lab-validated. Executed by the maintainer in a personally controlled laboratory environment on the date shown. Table names, field names, and operator support still vary by tenant configuration, API version, connector, and add-on.

Before you act on a result

Is the HR feed authoritative and complete for this population?
Does an approved extension, legal hold, or rehire explain the account remaining enabled?
Could an alias or renamed account have produced an incorrect match?
Has downstream application access been revoked, not just the directory account?

Common questions

How do I check for residual access after termination in Splunk?: Run the published SPL query on this page against Splunk Enterprise / Enterprise Security. It reads index=identity (directory), hr_termination_events.csv (lookup) and reports: Identity still enabled after the recorded termination date, with no unexpired access extension.
What permissions are needed to run this Splunk query?: Search access to the identity index; Read on the lookup.
What evidence does AC-2 need that Splunk cannot produce?: HR termination events (hr_termination_events.csv). Establishes when an individual's employment ended so directory state can be compared against it. Without this file, an enabled account is just an enabled account — there is nothing to compare it to. At minimum it must carry: user_principal_name, employment_status, effective_date.
Does a result from this query mean the control has failed?: An enabled account does not by itself establish unauthorized access or a control failure. Identifier quality, export timing, and accounts held in other directories all remain contextual.

Terms used on this page

NIST SP 800-53the U.S. federal catalogue of security requirements: The catalogue of security and privacy requirements published by the National Institute of Standards and Technology, a U.S. federal agency. U.S. government systems are measured against it, and many private organizations adopt it voluntarily. Each requirement has an identifier such as AC-2. Official source →
CISACybersecurity and Infrastructure Security Agency: The U.S. federal agency responsible for national critical-infrastructure cybersecurity. Its publications are works of the U.S. government and are free to use. Official source →
SPLSearch Processing Language: The language used to ask questions of data held in Splunk. A query written in it is text and can be read before it is run.
CPGCross-Sector Cybersecurity Performance Goals: A voluntary baseline of security practices published by the U.S. Cybersecurity and Infrastructure Security Agency, written specifically for organizations too small to employ security staff. It is a short, plainly written starting list rather than a full standard. Official source →
lab-validatedexecuted in a controlled test environment: The check has been run, by the maintainer, against real security software loaded with purpose-built test data, and what it returned was recorded. It has not been run on any real organization's data.

Every term this project uses →