8.2.6User identification and related accounts for users and administrators are strictly managed throughout an account’s lifecycle

Defined Approach Requirements:

Inactive user accounts are removed or disabled within 90 days of inactivity.

Defined Approach Testing Procedures:

8.2.6 Examine user accounts and last logon information, and interview personnel to verify that any inactive user accounts are removed or disabled within 90 days of inactivity.