Establish and Maintain an Inventory of Accounts
Description
Establish and maintain an inventory of all accounts managed in the enterprise. The inventory must include both user and administrator accounts. The inventory, at a minimum, should contain the person’s name, username, start/stop dates, and department. Validate that all active accounts are authorized, on a recurring schedule at a minimum quarterly, or more frequently.
Implementation Checklist
Tool Recommendations
Cloud identity and access management with SSO, MFA, conditional access, and identity governance
Microsoft · Per-user subscription (P1/P2)
Identity governance and administration platform with access certification, lifecycle management, and AI-driven access intelligence
SailPoint · Per-identity subscription
Privileged access management platform for securing, managing, and auditing privileged credentials and sessions
CyberArk · Per-user subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Orphaned Account Abuse by Former Employees
ConfidentialityFormer employees, contractors, or third parties retain active accounts that are not tracked in an inventory, using them to access systems and data after their authorization has ended.
Privilege Accumulation in Untracked Accounts
ConfidentialityAccounts not tracked in an inventory accumulate permissions over time through role changes without review, creating over-privileged accounts that represent high-value targets.
Compromised Shared Account Without Attribution
IntegrityShared or generic accounts not captured in the inventory are compromised, and investigations cannot attribute actions to a specific individual due to lack of account tracking.
Vulnerabilities (When Safeguard Absent)
No Centralized Account Inventory
Without a maintained inventory of all accounts, the organization cannot determine how many accounts exist, who owns them, or whether they are all still authorized.
No Recurring Account Authorization Validation
Without quarterly reviews against the account inventory, unauthorized or orphaned accounts persist indefinitely without detection or remediation.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Document | Current inventory or catalog documentation | Maintained continuously, reviewed quarterly |
| Document | Process/procedure documentation for identification activities | Reviewed annually |
| Technical | Asset/software inventory export with required fields populated | Exported quarterly for review |
| Record | Inventory review meeting minutes or sign-off | Per review cycle |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |