User Account Management

Applies to. Requirements 7 and 8 set the account lifecycle. Requirement 8 asks that every user gets a unique ID before access, that shared or generic accounts are used only on a documented exception basis, that additions, deletions and changes to user IDs and credentials are authorised and implemented with only the approved privileges, and that inactive accounts are removed or disabled within 90 days. Requirement 7 adds a review of all user accounts and their access privileges at least once every six months.