Default Account

Applies to. 2.2.2 sets the rule: if a vendor default account will be used, its default password is changed to meet Requirement 8's password rules; if it will not be used, the account is removed or disabled. That applies to every system component in scope, from the built-in administrator on a server, database or network device to the service accounts an installer creates without anyone noticing. Testing procedure 2.2.2.b has the assessor watch an administrator log on with the vendor defaults to see what still works.

Example. A merchant deploys a new database server. The installer creates the vendor's administrative account and two maintenance accounts, each with a password printed in the documentation. The team changes the administrative password and disables both maintenance accounts. At assessment, 2.2.2.c is met by showing the configuration file with the two accounts disabled.

Limits. A default account is not the same thing as a default password, though they usually arrive together. The account is the identity; the password is the credential. Changing the password removes one risk and leaves another: a well-known account name still tells an attacker whom to target, which is why 2.2.2 has a separate branch for accounts that will not be used, remove or disable them. The term covers accounts predefined by the vendor or generated during installation, not accounts an administrator creates later and leaves weak; those fall under Requirement 8, not 2.2.2.