CCI-003627
Disable accounts when the accounts have expired.
The Ubuntu operating system must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.
1 rule found Severity: Medium
The Cisco ISE must be configured to use an external authentication server to authenticate administrators prior to granting administrative access.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: High
The Juniper EX switch must be configured to use an authentication server for the purpose of authenticating users prior to granting administrative access.
1 rule found Severity: High
1 rule found Severity: Medium
Microsoft Intune service must automatically disable accounts and identifiers (individuals, groups, roles, and devices) after a 35-day period of account inactivity.
1 rule found Severity: Medium
2 rules found Severity: Low
1 rule found Severity: Medium
The Oracle Linux operating system must disable account identifiers (individuals, groups, roles, and devices) if the password expires.
1 rule found Severity: Medium
The Riverbed NetProfiler must be configured to use an authentication server to authenticate users prior to granting administrative access.
2 rules found Severity: High
The TippingPoint SMS must be configured with only one local account to be used as the account of last resort in the event the authentication server is unavailable.
1 rule found Severity: Medium
The TippingPoint SMS must be configured to use an authentication server for the purpose of authenticating users prior to granting administrative access and to enforce access restrictions.
1 rule found Severity: High
TOSS must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.
1 rule found Severity: Medium
10 rules found Severity: Medium
NixOS must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.
1 rule found Severity: Medium
1 rule found Severity: Medium
The application server must disable identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.
1 rule found Severity: Medium
The application must disable device identifiers after 35 days of inactivity unless a cryptographic certificate is used for authentication.
1 rule found Severity: Medium
Ubuntu 22.04 LTS must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.
1 rule found Severity: Medium
The Central Log Server must disable accounts (individuals, groups, roles, and devices) after 35 days of inactivity.
1 rule found Severity: Medium
The container platform must disable identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.
1 rule found Severity: Medium
Forescout must be configured to use an authentication server for the purpose of authenticating users prior to granting administrative access.
1 rule found Severity: Medium
The operating system must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.
1 rule found Severity: Medium
1 rule found Severity: Medium
ACF2 system administrator must develop a procedure to disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.
1 rule found Severity: Medium
CA-TSS security administrator must develop a process to suspend userids found inactive for more than 35 days.
1 rule found Severity: Medium
The Juniper SRX Services Gateway must be configured to use an authentication server to centrally manage authentication and logon settings for remote and nonlocal access.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
Access to Prisma Cloud Compute must be managed based on user need and least privileged using external identity providers for authentication and grouping to role-based assignments when possible.
1 rule found Severity: Medium
The OL 8 system-auth file must disable access to the system for account identifiers (individuals, groups, roles, and devices) with 35 days of inactivity.
1 rule found Severity: Medium
The OL 8 password-auth file must disable access to the system for account identifiers (individuals, groups, roles, and devices) with 35 days of inactivity.
1 rule found Severity: Medium
RHEL 8 account identifiers (individuals, groups, roles, and devices) must be disabled after 35 days of inactivity.
1 rule found Severity: Medium
RHEL 9 must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.
1 rule found Severity: Medium
The SUSE operating system must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity after password expiration.
2 rules found Severity: Medium
The VMM must disable local account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.
1 rule found Severity: Medium
The vCenter Server must uniquely identify and authenticate users or processes acting on behalf of users.
1 rule found Severity: Medium
Rancher MCM must use a centralized user management solution to support account management functions. For accounts using password authentication, the container platform must use FIPS-validated SHA-2 or later protocol to protect the integrity of the password authentication process.
1 rule found Severity: High