IA.L2-3.5.6
Identifier Handling
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee IA.L2-3.5.6 in the reference catalog with its NIST cross-references
Official requirement
Disable identifiers after a defined period of inactivity.
Assessment objectives
a. a period of inactivity after which an identifier is disabled is defined; and
b. identifiers are disabled after the defined period of inactivity.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Disable identifiers after the organization-defined period of inactivity.
Implementation example
Example from the source assessment guide (not a mandatory implementation): One of your responsibilities is to enforce your company ’s inactive account policy: any account that has not been used in the last 45 days must be disabled [a]. You enforce this by writing a script that runs once a day to check the last login date for each account and generates a report of the accounts with no login records for the last 45 days. After reviewing the report, you notify each inactive employee’s supervisor and disable the account [b].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Identification and authentication policy; procedures addressing identifier management; procedures addressing account management; system security plan; system design documentation; system configuration settings and associated documentation; list of system accounts; list of identifiers generated from physical access control devices; other relevant documents or records
Common mistakes
Keeping unused accounts active because their owners might return.