FAQ #1066 Diff
Can you define "Inactive User" as used in PCI DSS requirement 8.5.5?
Earlier Version
Later Version
Removed
Added
An inactive user is one whose accountaccount is one that has not been used in over 90 days. Note that section 8.5 requirements only apply to “non-consumer users” or those individuals that access systems within the cardholder environment, including but not limited to employees, contractors, administrators, and other third parties.Inactive accounts are often targets for attackers since they are generally not monitored, and changes to the accounts (such as a changed password) could easily go unnoticed.
Removing or disabling inactive accounts reduces the risk that they will be used to gain unauthorized access to the environment.
(Note: PCI DSS Requirement numbers refer to PCI DSS version 3)
Removing or disabling inactive accounts reduces the risk that they will be used to gain unauthorized access to the environment.
(Note: PCI DSS Requirement numbers refer to PCI DSS version 3)
Disclaimer: This FAQ has been processed for display on this website and may contain errors. Please check the original FAQ on the PCI SSC website for the authoritative version.