NIST 800-171 3.5.6 (IA.L2-3.5.6): Inactive Accounts

What 3.5.6 means in practice

Accounts nobody has used for a defined period (90 days is common) are disabled, because a dormant account can be taken over without anyone noticing. Set the period, then disable such accounts automatically or through regular reviews, and keep the reports.

SPRS points and the CMMC POA&M

What an assessor checks for 3.5.6

NIST SP 800-171A gives 2 determination statements for 3.5.6, each found satisfied or other than satisfied. Determine if:

1. 3.5.6[a] a period of inactivity after which an identifier is disabled is defined.
2. 3.5.6[b] identifiers are disabled after the defined period of inactivity.

NIST SP 800-171A (June 2018), assessment objectives for 3.5.6

Evidence that shows 3.5.6 is met

• The defined inactivity period after which accounts are disabled.
• An automated job or identity provider setting that disables inactive accounts, or records of regular reviews.
• A report of accounts disabled for inactivity.

How PolicyCortex gathers the evidence

PolicyCortex reads this evidence with the collectors below, read only, and grades 3.5.6 from it. Each line says what the product checks.

• Microsoft Entra ID: Sign-in logs. Reads Microsoft Entra sign-in activity so that dormant accounts can be found and disabled.
• Okta: Directory. Checks that no Okta account that can sign in has gone 90 days without signing in.