Safeguard 5.1 Establish and maintain an inventory of accounts
An inventory of every account the enterprise manages (user, administrator and service), the minimum fields, and quarterly validation that each active account is authorized.
Control 5 Account management
CIS Control 5 Safeguards for the accounts themselves: account and service account inventories, unique passwords, dormant accounts, dedicated administrator accounts and centralized account management.
Safeguard 5.2 Use unique passwords
Unique passwords on every enterprise asset, with CIS best-practice minimum lengths of 8 characters for accounts using MFA and 14 characters for accounts without it.
Safeguard 5.3 Disable dormant accounts
Deleting or disabling accounts after 45 days of inactivity, where supported, and how assessors count dormant accounts that are still enabled.
Safeguard 5.4 Restrict administrator privileges to dedicated administrator accounts
Keeping administrator rights on separate, dedicated accounts and doing everyday browsing, email and office work from a non-privileged primary account.
Safeguard 5.5 Establish and maintain an inventory of service accounts
A dedicated inventory of service accounts with owning department, review date and purpose, reviewed at least quarterly: the IG2 extension of the account inventory in Safeguard 5.1.
Safeguard 5.6 Centralize account management
Managing accounts centrally through a directory or identity service: an IG2 Safeguard that CIS v8.1 assigns to the Govern function, measured by coverage across assets.
