Establish and Maintain an Inventory of Service Accounts
Description
Establish and maintain an inventory of service accounts. The inventory, at a minimum, must contain department owner, review date, and purpose. Perform service account reviews to validate that all active accounts are authorized, on a recurring schedule at a minimum quarterly, or more frequently.
Implementation Checklist
Tool Recommendations
Identity governance and administration platform with access certification, lifecycle management, and AI-driven access intelligence
SailPoint · Per-identity subscription
Cloud identity and access management with SSO, MFA, conditional access, and identity governance
Microsoft · Per-user subscription (P1/P2)
Cloud identity platform providing SSO, adaptive MFA, lifecycle management, and API access management
Okta · Per-user subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Service Account Credential Abuse for Persistent Access
ConfidentialityAttackers discover and compromise untracked service accounts with static passwords and elevated privileges, using them for persistent, stealthy access that survives user password resets.
Orphaned Service Account Exploitation
IntegrityService accounts created for decommissioned applications remain active with broad permissions, providing attackers with high-privilege access paths that no one monitors or reviews.
Vulnerabilities (When Safeguard Absent)
No Inventory of Service Accounts
Without a maintained service account inventory, the organization does not know how many service accounts exist, what they can access, or whether they are still needed.
Service Accounts Without Defined Ownership or Review
Without documented owners and recurring reviews, service accounts operate indefinitely without anyone verifying their authorization, access scope, or continued necessity.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Document | Current inventory or catalog documentation | Maintained continuously, reviewed quarterly |
| Document | Process/procedure documentation for identification activities | Reviewed annually |
| Technical | Asset/software inventory export with required fields populated | Exported quarterly for review |
| Record | Inventory review meeting minutes or sign-off | Per review cycle |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |