# AC-2(3) — Disable Accounts

- **Control ID:** AC-2(3)
- **Family:** [AC](/md/families/AC.md)
- **Baselines:** moderate, high
- **Enhancement of:** [AC-2](/md/controls/AC-2.md)

## Description

Disable accounts within \[assignment\] when the accounts: Have expired; Are no longer associated with a user or individual; Are in violation of organizational policy; or Have been inactive for \[assignment\].

## Discussion

Disabling expired, inactive, or otherwise anomalous accounts supports the concepts of least privilege and least functionality which reduce the attack surface of the system.

## Implementation guidance

No content available.

## CSF 2.0 subcategories

No content available.

## Related controls

No content available.

---

Derived from official NIST publications (NIST SP 800-53 Rev 5 and NIST CSF 2.0). nistcontrols.com is not affiliated with NIST.