STIGhub
STIGs
RMF Controls
Compare
← AC-2 (3) — Account Management
CCI-003628
Definition
Disable accounts when the accounts are no longer associated to a user.
Parent Control
AC-2 (3)
Account Management
Access Control
Linked STIG Checks (43)
V-263528
CAT II
AAA Services must be configured to disable accounts when the accounts are no longer associated to a user.
AAA Services Security Requirements Guide
V-279055
CAT I
ColdFusion must be using an enterprise solution for authentication.
Adobe ColdFusion Security Technical Implementation Guide
V-274149
CAT II
Amazon Linux 2023 must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.
Amazon Linux 2023 Security Technical Implementation Guide
V-268549
CAT II
The macOS system must disable accounts after 35 days of inactivity.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-277157
CAT II
The macOS system must disable accounts after 35 days of inactivity.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-263549
CAT II
The application server must disable accounts when the accounts are no longer associated to a user.
Application Server Security Requirements Guide
V-272627
CAT III
CylanceON-PREM must be configured to use a third-party identity provider.
Arctic Wolf CylanceON-PREM Security Technical Implementation Guide
V-276012
CAT I
Ax-OS must have no local accounts for the user interface.
Axonius Federal Systems Ax-OS Security Technical Implementation Guide
V-260547
CAT II
Ubuntu 22.04 LTS must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.
Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide
V-270683
CAT II
Ubuntu 24.04 LTS must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.
Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide
V-263557
CAT II
The Central Log Server must disable accounts when the accounts are no longer associated to a user.
Central Log Server Security Requirements Guide
V-242633
CAT II
The Cisco ISE must be configured to use an external authentication server to authenticate administrators prior to granting administrative access.
Cisco ISE NDM Security Technical Implementation Guide
V-263586
CAT II
The container platform must disable accounts when the accounts are no longer associated to a user.
Container Platform Security Requirements Guide
V-263603
CAT II
The DBMS must disable accounts when the accounts are no longer associated to a user.
Database Security Requirements Guide
V-263624
CAT II
The DNS server implementation must disable accounts when the accounts are no longer associated to a user.
Domain Name System (DNS) Security Requirements Guide
V-230952
CAT II
Forescout must be configured to use an authentication server for the purpose of authenticating users prior to granting administrative access.
Forescout Network Device Management Security Technical Implementation Guide
V-263650
CAT II
The operating system must disable accounts when the accounts are no longer associated to a user.
General Purpose Operating System Security Requirements Guide
V-223577
CAT II
The IBM z/OS system administrator (SA) must develop a procedure to automatically remove or disable temporary user accounts after 72 hours.
IBM z/OS ACF2 Security Technical Implementation Guide
V-223761
CAT II
The IBM z/OS system administrator (SA) must develop a process to disable emergency accounts after the crisis is resolved or 72 hours.
IBM z/OS RACF Security Technical Implementation Guide
V-223798
CAT II
IBM z/OS system administrator must develop a procedure to remove or disable temporary user accounts after 72 hours.
IBM z/OS RACF Security Technical Implementation Guide
V-224035
CAT II
IBM z/OS system administrator (SA) must develop a procedure to remove or disable temporary user accounts after 72 hours.
IBM z/OS TSS Security Technical Implementation Guide
V-224036
CAT II
IBM z/OS system administrator (SA) must develop a procedure to remove or disable emergency accounts after the crisis is resolved or 72 hours.
IBM z/OS TSS Security Technical Implementation Guide
V-258600
CAT I
The ICS must be configured to prevent nonprivileged users from executing privileged functions.
Ivanti Connect Secure NDM Security Technical Implementation Guide
V-253941
CAT I
The Juniper EX switch must be configured to use an authentication server for the purpose of authenticating users prior to granting administrative access.
Juniper EX Series Switches Network Device Management Security Technical Implementation Guide
V-223206
CAT II
The Juniper SRX Services Gateway must be configured to use an authentication server to centrally manage authentication and logon settings for remote and nonlocal access.
Juniper SRX Services Gateway NDM Security Technical Implementation Guide
V-263670
CAT II
The Mainframe Product must disable accounts when the accounts are no longer associated to a user.
Mainframe Product Security Requirements Guide
V-278003
CAT II
Outdated or unused accounts on Windows Server 2025 must be removed or disabled.
Microsoft Windows Server 2025 Security Technical Implementation Guide
V-248703
CAT II
The OL 8 system-auth file must disable access to the system for account identifiers (individuals, groups, roles, and devices) with 35 days of inactivity.
Oracle Linux 8 Security Technical Implementation Guide
V-248704
CAT II
The OL 8 password-auth file must disable access to the system for account identifiers (individuals, groups, roles, and devices) with 35 days of inactivity.
Oracle Linux 8 Security Technical Implementation Guide
V-271849
CAT II
OL 9 must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.
Oracle Linux 9 Security Technical Implementation Guide
V-273835
CAT I
The RUCKUS ICX device must be configured to use at least two authentication servers for the purpose of authenticating users prior to granting administrative access.
RUCKUS ICX NDM Security Technical Implementation Guide
V-281175
CAT II
RHEL 10 must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-258049
CAT II
RHEL 9 must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.
Red Hat Enterprise Linux 9 Security Technical Implementation Guide
V-256093
CAT I
The Riverbed NetProfiler must be configured to use an authentication server to authenticate users prior to granting administrative access.
Riverbed NetProfiler Security Technical Implementation Guide
V-216344
CAT II
User accounts must be locked after 35 days of inactivity.
Solaris 11 SPARC Security Technical Implementation Guide
V-216109
CAT II
User accounts must be locked after 35 days of inactivity.
Solaris 11 X86 Security Technical Implementation Guide
V-242237
CAT II
The TippingPoint SMS must be configured with only one local account to be used as the account of last resort in the event the authentication server is unavailable.
Trend Micro TippingPoint NDM Security Technical Implementation Guide
V-242254
CAT I
The TippingPoint SMS must be configured to use an authentication server for the purpose of authenticating users prior to granting administrative access and to enforce access restrictions.
Trend Micro TippingPoint NDM Security Technical Implementation Guide
V-252953
CAT II
TOSS must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.
Tri-Lab Operating System Stack (TOSS) 4 Security Technical Implementation Guide
V-282502
CAT II
TOSS 5 must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.
Tri-Lab Operating System Stack (TOSS) 5 Security Technical Implementation Guide
V-264315
CAT II
The VMM must disable accounts when the accounts are no longer associated to a user.
Virtual Machine Manager Security Requirements Guide
V-264338
CAT II
The web server must disable accounts when the accounts are no longer associated to a user.
Web Server Security Requirements Guide
V-269574
CAT I
Xylok Security Suite must use a centralized user management solution.
Xylok Security Suite 20.x Security Technical Implementation Guide