ASD Essentials IT.PRO-13.1 Regularly Find and Disable or Remove Default and Unused Accounts
What it says
Identify and disable or remove default and unused accounts regularly, permitting exceptions only where the account is documented, justified, hardened and monitored.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishFinds and switches off or deletes built-in and unused accounts regularly, keeping any only if documented, justified, locked down and monitored.
Systems often come with built-in vendor accounts, and unused accounts pile up, such as those of former staff or old test logins. To meet this, the organisation finds these accounts on every system within a set review period. It switches them off or deletes them within set timeframes. An account may stay only with a written, approved reason, and it must be locked down and its use watched.
Free. Save your status, tasks and notes.
Where this action applies
What's in each domain?ASD orders the work by domain: apply this action to each ticked domain, phase by phase.
- Phase 3
Why it matters
Attackers can sign in with a vendor's published default password, or a stolen or guessed password for an unused account. The access looks normal. On internet-facing, sign-in or admin systems, one such account can give an attacker lasting admin control.
How to implement
The identity and access owner should set the review period and how long without use makes an account unused.
Also set the timeframes for switching off or deleting accounts, and cover every asset in the asset list.
System owners should find each asset's built-in vendor accounts, such as a printer's default admin login, and switch off or delete them during setup.
Any that must stay go through the exception process, not just a password change.
Identity and system administrators should schedule a report of every account with no sign-in or other use in the set period.
Include staff, admin, vendor and app accounts, in every place accounts are kept.
The identity team should switch off each flagged account without an approved exception within the set timeframe.
Delete it once the owner confirms it is not needed, and track each step in a ticket.
The head of security should let an account stay only through an exceptions register recording its owner, reason and approval.
The account must be locked down and watched, and each exception rechecked at every review.
Keep it running
The identity team runs the review on the set cycle, using last sign-in data from the directory and sign-in service. The common gap is local accounts on firewalls, routers, other appliances, servers and laptops, held outside the directory, so collect them separately. Exclude approved emergency access accounts from the clean-up, but alert on every sign-in. Follow ASD's priority order: internet-facing and sign-in systems first, then critical and admin systems, then business systems and staff devices.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the review period, the latest completed account reviews and the asset list.
Look at
Whether a review finished within the period, and which assets, such as firewalls or routers, it missed.
Good evidence
Reviews finish on time and cover every asset in the list.
- Check 2 of 5What an auditor asks for
Ask for
Request live account lists for sampled systems, including a firewall, router or other appliance.
Look at
Whether built-in vendor accounts are still on with no recorded reason, locking down or monitoring.
Good evidence
Every built-in account is switched off, deleted or an approved, monitored exception.
- Check 3 of 5What an auditor asks for
Ask for
Ask for the report that finds accounts unused within the set period, and its latest output.
Look at
Whether it runs on schedule and covers every place accounts are kept, or only the central directory.
Good evidence
A scheduled report finds every unused account, on every asset and wherever accounts are kept.
- Check 4 of 5What an auditor asks for
Ask for
Request the tickets for unused accounts found in the last cycle.
Look at
Whether accounts stayed on past the timeframe, or a live spot check finds unused accounts the review missed.
Good evidence
Unused accounts without an exception are switched off or deleted within the set timeframe.
- Check 5 of 5What an auditor asks for
Ask for
Ask for the exceptions register and proof that one sampled exception is locked down and watched.
Look at
Whether exceptions lack approval or a review date, or locking down and alerts exist only on paper.
Good evidence
Each exception is recorded, justified, locked down and watched, and only approved emergency accounts skip clean-up.
ASD indicators of good practice (9)
The indicators below are quoted as published from ASD's Assessment evidence guide for enterprise IT. These optional indicators help an assessor judge the action in each domain where it applies: if any not effective statement is true, the action is rated not effective; if every applicable fully effective statement is true and no other statement is, it is rated fully effective; otherwise it is rated partially effective. ASD says the indicators "do not replace expert judgement, nor are they intended to serve as a checklist".
Not effective(3)
- NE-1No review of default or unused accounts has been conducted within the review period defined by the organisation.
- NE-2Default vendor accounts remain enabled on production systems without appropriate documentation, justification, hardening and monitoring in place for their use.
- NE-3No process exists to identify accounts that have not authenticated within a defined period.
Partially effective(3)
- PE-1A review has been conducted but does not cover all assets.
- PE-2Default accounts have been identified but some remain enabled without documented justification.
- PE-3Unused accounts are identified but remediation is incomplete or delayed beyond defined timeframes.
Fully effective(3)
- FE-1A review of accounts has been completed within the defined review period covering all assets.
- FE-2Default accounts are disabled or have approved justification for remaining active, with appropriate monitoring and compensating controls for their use in place.
- FE-3Accounts that show no evidence of use, other than approved emergency access accounts, are identified and either disabled or removed in accordance with defined timeframes.
Mappings
Closest match in ISO/IEC 27001: A.5.16, Identity life cycle management, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.16.
IT.PRO-13.1 requires default and unused accounts to be identified and disabled or removed regularly, with exceptions only where an account is documented, justified, hardened and monitored. This is a specific part of managing the full life cycle of identities required by ISO/IEC 27001 Annex A 5.16, particularly the removal of identities that are no longer needed. Annex A 5.16 also covers how identities are created and changed, while IT.PRO-13.1 focuses on default and unused accounts.
This control partially meets A.5.18.
IT.PRO-13.1 requires default and unused accounts to be identified and disabled or removed regularly, with exceptions only where an account is documented, justified, hardened and monitored. Regularly identifying and removing these accounts is a specific case of the review and removal of access rights required by ISO/IEC 27001 Annex A 5.18. Annex A 5.18 also covers provisioning and modifying access rights for all users, while IT.PRO-13.1 targets only default and unused accounts.
ASD Essential Eight: 2 mappings
This control partially overlaps E8-RA-ML2.1.
IT.PRO-13.1 requires default and unused accounts to be regularly identified and disabled or removed; E8-RA-ML2.1 requires privileged access to systems, applications and data repositories to be disabled after 12 months unless revalidated, a related periodic clean-up.
This control partially overlaps E8-RA-ML2.2.
IT.PRO-13.1 requires default and unused accounts to be regularly identified and disabled or removed; E8-RA-ML2.2 requires privileged access to systems and applications to be disabled after 45 days of inactivity, a specific case of disabling unused privileged access.
ASD Information Security Manual: 3 mappings
This control partially overlaps ISM-0380.
IT.PRO-13.1 requires regularly disabling or removing default and unused accounts, with only documented, justified, hardened and monitored exceptions; ISM-0380 overlaps on accounts, disabling or removing unneeded operating system user accounts, components, services and functionality.
This control partially overlaps ISM-0383.
IT.PRO-13.1 requires default and unused accounts to be regularly identified and disabled or removed; ISM-0383 requires default operating system accounts or credentials to be changed, disabled or removed during initial setup, addressing the default account part.
This control partially overlaps ISM-1260.
IT.PRO-13.1 requires default and unused accounts to be regularly identified and disabled or removed; ISM-1260 requires default server application accounts or credentials to be changed, disabled or removed during initial setup, addressing the default account part.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.