NIST SP 800-53 - AC-2(3)

AC-2(3) is a control enhancement to AC-2, Account Management. Where the parent control governs the full lifecycle of system accounts - requesting, approving, provisioning, reviewing - this enhancement handles one specific, high-value job: shutting accounts off when they no longer have a reason to be on.

Like many NIST controls, AC-2(3) allows an organisation to tailor the control to their needs via an unbound time period: “within [time period]”.

The primary goal of NIST SP 800-53 control enhancement AC-2(3): Disable Accounts is to reduce a system’s attack surface by automatically disabling accounts that are inactive, expired, or no longer required. This prevents threat actors from exploiting dormant credentials to gain unauthorized access or move laterally within a network.

When this control is absent or slow to be actioned it can lead to compromise.

• Staff who left The classic case: an employee or contractor leaves, the account survives, allowing them a path back in.
• Account is found via external threat Password spraying and credential stuffing succeed disproportionately against stale accounts: passwords are old, MFA enrollment is often missing or tied to a returned device, and the true owner will never report the anomaly.
• Persistence Post-compromise, attackers deliberately seek out disabled-in-name-only or forgotten accounts (MITRE ATT&CK T1078, Valid Accounts) as durable footholds. A dormant service account with a non-expiring password is ideal as it may survive regulr password reset periods and disablements.

Rev	Issue	Description of Change
A	SP 800-53 Rev 4	Enhancement titled “Disable Inactive Accounts” - inactivity was the only trigger, automatic disable required.
B	SP 800-53 Rev 5	Retitled “Disable Accounts.” Scope widened to four trigger conditions (expired, orphaned, policy violation, inactive) with an organization-defined reaction period.