ASD ISM 1404 Disabling inactive user access after 45 days
What it says
Unprivileged access to systems and their resources are disabled after 45 days of inactivity.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishIf a user doesn't use their system access for 45 days, it's disabled to keep the system secure.
Every 45 days, if someone hasn't used their access to a system, it gets turned off. This helps protect your organisation by making sure only active and engaged users can access important systems, reducing the risk of unauthorised access if an account is forgotten or abandoned.
Free. Save your status, tasks and notes.
Why it matters
If inactive unprivileged accounts aren't disabled after 45 days, stale credentials can be exploited for unauthorised access and data compromise.
How to implement
The IT team should set up an automated system to track user activity.
Use software that logs user logins and flags any account that hasn't been accessed in 45 days. This helps ensure that inactive accounts can be disabled promptly without manual tracking.
HR should regularly update the IT team about employee status.
Inform the IT team when staff leave or change roles to ensure that access is disabled if it's no longer needed. This coordination helps prevent security gaps when personnel changes occur.
Managers should communicate the importance of logging in regularly.
Encourage employees to access required systems at least once a month to maintain their access. This practice keeps employees engaged and ensures their access rights remain relevant.
The IT team should develop a procedure for reactivating accounts.
Create a simple process for users to request access restoration if needed, including approvals from their manager. This ensures that the system is secure but still responsive to business needs.
The security officer should train staff annually on secure access habits.
Include guidance on logging out after use and using access only when needed. Training reinforces the importance of maintaining secure access controls within the organisation.
Keep it running
Review last logon/activity regularly and automatically disable unprivileged user accounts after 45 days of inactivity, with documented reactivation approval.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The user access report from the IT team.
Look at
The list to see dates of last login for each user.
Good evidence
Shows all user accounts with a 'last login' date within the last 45 days or a status of 'disabled' if not used.
- Check 2 of 5What an auditor asks for
Good evidence
Provides evidence of regular deactivations in line with policy.
- Check 3 of 5What an auditor asks for
Ask for
To see the HR to IT update procedure. Check that there's a documented process for updating user statuses with timelines for communication.
Good evidence
Includes clear instructions and demonstrates routine updates.
- Check 4 of 5What an auditor asks for
Good evidence
Shows a documented request and approval for each reactivated account.
- Check 5 of 5What an auditor asks for
Ask for
Records of staff training sessions on security.
Look at
Attendance records and training content details.
Good evidence
Includes a training schedule, participant lists, and session summaries indicating discussion of access controls.
Mappings
Closest match in ISO/IEC 27001: A.5.15, Access control policies and procedures, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.15.
ISM-1404 mandates a specific access control rule: disabling unprivileged access after 45 days of inactivity. Annex A 5.15 requires organisations to establish and implement access control policies and procedures based on business and security requirements. ISM-1404 can be implemented as a specific procedure/rule under the policy framework described by Annex A 5.15, but Annex A 5.15 is broader and does not prescribe a 45-day inactivity threshold.
This control partially meets A.5.18.
Annex A 5.18 requires organisations to remove or adjust access rights in line with policy and business rules, including when access is no longer needed. ISM-1404 is a specific rule for disabling unprivileged access after 45 days of inactivity, which is one concrete removal/adjustment trigger within an access management program. Annex A 5.18 is broader because it does not prescribe a single inactivity threshold and applies to all access types and assets.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.