CCI-000795

The organization manages information system identifiers by disabling the identifier after an organization-defined time period of inactivity.

4 rules found Severity: Medium

14 rules found Severity: Medium

2 rules found Severity: Medium

1 rule found Severity: Medium

1 rule found Severity: Low

2 rules found Severity: Medium

1 rule found Severity: Medium

4 rules found Severity: Low

1 rule found Severity: Medium

1 rule found Severity: High

1 rule found Severity: Medium

2 rules found Severity: Medium

1 rule found Severity: Medium

3 rules found Severity: Medium

1 rule found Severity: High

CCI-000795

Set Account Expiration Following Inactivity

Set existing passwords a period of inactivity before they been locked

Set Account Expiration Following Inactivity in password-auth

Set Account Expiration Following Inactivity in system-auth

Compliance Guardian must provide automated mechanisms for supporting account management functions.

The HP FlexFabric Switch must disable identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.

IBM Aspera Faspex must disable account identifiers after 35 days of inactivity.

The MQ Appliance must disable identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.

The IBM z/VM Security Manager must provide a procedure to disable userIDs after 35 days of inactivity.

Nutanix AOS must be configured to disable user accounts after the password expires.

The Ubuntu operating system must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.

The Red Hat Enterprise Linux operating system must disable account identifiers (individuals, groups, roles, and devices) if the password expires.

JBoss management Interfaces must be integrated with a centralized authentication mechanism that is configured to manage accounts according to DoD policy.

MKE must be configured to integrate with an Enterprise Identity Provider.

Unused accounts must be disabled or removed from the system after 35 days of inactivity.

Outdated or unused accounts must be removed from the system or disabled.

The Oracle Linux operating system must disable account identifiers (individuals, groups, roles, and devices) if the password expires.

SLEM 5 must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity after password expiration.

The macOS system must disable accounts after 35 days of inactivity.

The application must disable device identifiers after 35 days of inactivity unless a cryptographic certificate is used for authentication.

Ubuntu 22.04 LTS must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.

AlmaLinux OS 9 must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.

Dragos Platform must use an Identity Provider (IDP) for authentication and authorization processes.

Windows Server 2019 outdated or unused accounts must be removed or disabled.

Windows Server 2022 outdated or unused accounts must be removed or disabled.

Access to Prisma Cloud Compute must be managed based on user need and least privileged using external identity providers for authentication and grouping to role-based assignments when possible.

The OL 8 system-auth file must disable access to the system for account identifiers (individuals, groups, roles, and devices) with 35 days of inactivity.

The OL 8 password-auth file must disable access to the system for account identifiers (individuals, groups, roles, and devices) with 35 days of inactivity.

OpenShift must use FIPS validated LDAP or OpenIDConnect.

RHEL 8 account identifiers (individuals, groups, roles, and devices) must be disabled after 35 days of inactivity.

RHEL 9 must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.

The SUSE operating system must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity after password expiration.

User accounts must be locked after 35 days of inactivity.

The Photon operating system must disable new accounts immediately upon password expiration.

The vCenter Server must uniquely identify and authenticate users or processes acting on behalf of users.

Rancher MCM must use a centralized user management solution to support account management functions. For accounts using password authentication, the container platform must use FIPS-validated SHA-2 or later protocol to protect the integrity of the password authentication process.