03.01.01 Account Management

a. Define the types of system accounts allowed and prohibited. b. Create, enable, modify, disable, and remove system accounts in accordance with policy, procedures, prerequisites, and criteria. c. Specify: 1. Authorized users of the system, 2. Group and role membership, and 3. Access authorizations (i.e., privileges) for each account. d. Authorize access to the system based on: 1. A valid access authorization and 2. Intended system usage. e. Monitor the use of system accounts. f. Disable system accounts when: 1. The accounts have expired, 2. The accounts have been inactive for [time period], 3. The accounts are no longer associated with a user or individual, 4. The accounts are in violation of organizational policy, or 5. Significant risks associated with individuals are discovered. g. Notify account managers and designated personnel or roles within: 1. [time period] when accounts are no longer required. 2. [time period] when users are terminated or transferred. 3. [time period] when system usage or the need-to-know changes for an individual. h. Require that users log out of the system after [time period] of expected inactivity or when [circumstances].

Quoted verbatim from NIST SP 800-171 Rev 3, which is in the public domain.